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I, Tnt.ro<luctlon 


In this report we summarize the results of the research efforts 
under Grant NSG-1U2 from March 15, 1975 through November 10, 1975. The 
personnel involved in this project during this period were Prof. A.S. Willsky, 
Ur. S. B. Gershwin, Mr. R. Bueno, and Mr. E. Chow. Mr. Bueno and Mr. Chow 
are graduate students working towards S.M. degree- and theses based on 
tb'.ir work on this project will be forthcoming (February 1965 for Chow 
and September 1976 for Bueno). 

Before we outline the report, we first describe several other 
activities related to this grant. As we ser it, the purpose of this 
research effort is to perform a fundamental study of the problem of failure 
detection and reliable system design for digital aircraft control systems. 

The research efforts described herein represents a major step in this study, 
and at the end of this report we will outline several of the step which 
will be examined next. In addition to this work. Prof. Willsky undertook 
a detailed survey of failure detection methods, and this effort culminated 
in the survey paper [31, which is included as Appendix A. Also, during this 
time period, close contact was established with staff at the Charles Stark 
Draper Laboratory (in particular Mr. J. C. Deckert, Dr. J. J. Deyst, Jr., 
and Dr. M. Desai) working on NASA Langley Contract KASl-13914. specifically. 
Prof. Willsky has been involved on a regular basis as a consultant, and Mr. 

E. Chow will join the CSDL research staff on this project on a full-time 
basis beginning in mid-January. This project, which is of a more applied 
nature than Grant NSG-1112, has complemented the research at the Electronic 
systems Laboratory quite well . The CSDL program has provided a test-bed for 
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many of the concepts developed at ESL, it has also suggested several new, 
fundamental issues which will be explored at ESL, the project has pro- 
vided a learning experience for graduat? students who can then fit into the 
ongoing CSDL project, and, finally, the results of the CSDL study will 
provide several important pieces in our overall effort to develop a fault- 
tolerant control system design methodology. We feel that the present 
cooperative arrangement between ESL and CSDL provides an ideal balance for 

research and developinent in ^his area* 

AS bMkground for th. «rk desctib«J in this retort, we refer the 
—A., to the earlier research report (21 . We review some of the notation 
and the problem formulation. We have concentrated cur attenticn on four 

basic ’'failure modes": 

1. State step 

x(k + 1) = <Hk + Id h)x(k) + w(k) + 
z(k) e H(k)x(k) + v(k) 

2. State jump 

x(k + 1) * <Hk + Id k)x(k) + w(k) + 
z(k) » H(k)x(k) + v(k> 

3. Sensor step 

x(k+l) » ♦(k+l, k)x(k) + w(k) 
z(k) - H(k)x(k) + v(k) + Oj^ qV 

SehSOE jump 

. *(k + 1# k)x(k) + w(k) 

K(k) - H(k)x(k) + vtk) + 
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tte have proposed a number of other failure models, but have eoncontratod 
on these four, since they provide a simple and analytically tractable 
framework for this basic study and also since i is felt that detectors 
based on these models should be able to detect other failures (such as 
“off failures"). 

Recall that the GLR approach involves the implementation of a 
Kalman filter based on a "no failure" assun^tion. In this case the filter 
Innovations take the form 

Y(k) = G^(k; 0)v + Y(k) 

where Y is the residual if there is no failure, V is the failure magnitude, 

0 the failure time, and i the failure "ode. The precomputable matrix 
Gj^(k> 0> is called the failure signature and characterizes the way in which 
a failure of type i propagates through the system and filter. The GLR 
system examines the residuals, determines if there is a failure, and then 
estimates the time and magnitude of the failure, as well as deciding on 
failure type. In order tc keep the detector computationally tractable, 
we search over a "window of residuals" — i.e. we restrict our estimate 
of 0 to lie in the range 

){-M<0<,k-N 

A sli^tly simplified version of GLR is simplifi ed GLR (SGLR) in which one 
hypothesizes a value for V, thus avoiding the problem of estimation of v. 

The utility of this approach is that it is quite similar in performance 
characteristics to GLR, it requires less computation, and it is more readily 

analyzed than full GLR (see the next section) . 

In the previous report, we developed the basic GLR and SGLR equations 


for all four failure mcxles, and described the first stops in developing 
a GLR computer package. In this report we describe progress along 
several lines. Section II deals with several analytical tf-«’«« that have 
been and are being developed in order to gain insight into the workings 
of GLR and also to provide some tools for the inevitable design tradeoff 
studies. We consider the usual probabilities of false alarm and correct 
detection, but we also define and consider several other probabilities of 
interest. One of these is called cross detection probability, and it 
represents a measure of the indistinguishability of different failure 
inodes. The other is wrong tiu.e detection (l.e. detecting a failure at 
the incorrect time) . This is a useful piece of information in evaluating 
the overall performance of GLR. since, if some of the wrong time probabilities 
are large, one can improve overall detector performance by examining a 
window of values for 6. A number of issues involving these performance 
measures axB discussed in Section II. 

In Section III we describe the test problem used in our studies* We 
have used a second order, simplified iiodel of tdie longitudinal dynamics of 
the P-8 aircraft. In Section IV we discuss the application of the perform- 
ance tools of Section II to the test problem, and in Section V we describe 
the results of a set of simulation runs. We have attempted in this latter 
section to describe tlie qualitative behavior of detector performance. 

Section VI contains a description of the GLR eonputer package that has been 
developed. The present package allows one to perform a variety of analytiral 
tests (Sec. 11) and to simulate system performance. One can run several 
types of detectors simultaneously, thus allowing a study of cross-detection 
behavior, in addition, one can design detrrtors based on one system model 


and can simulate its performance when the real system is different. This 
option will allow us to study the robustness of the detector. 

We note that the presentation given here is somewhat unpolished as 
represents a status and not a final report. Thus» there are numerous 
loose ends and open questions throughout the report. We have collected 
these in Section VII in which we describe the next tasks oo be undertaken 
More finished descriptions of our research, will be forthcoming (specif i- 
cally» in the theses of Chow and Bueno). 
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II , Parformtmcp !.c aaure8 and probability computationg 


In this section, we report our efforts in studying the performance 
of the GLR technique. We define the probabilities of correct detection, 
false alarm, cross detection and wrong time as some measures of performance. 
Since these quantities provide incomplete evaluation of the detection 
scheme, their significance and limitations are discussed. It is shown 
that these probabilities require the evaluation of chi squared and gaussian 
integrals for the full GLR and simplified GLR respective!/. Computational 
algorithms for such probabilities are presented, ifs an exan^le of applying 
these performance measures, probabilities of correct detections and false 


alarms for the second order model of t»»« F-8 aircraft are considered in 

Section IV. Such analytic il resu. will be verified ’ / the simulation 

studies described in a later section (Section V) . 

The prcliabilities of correct detection (Pj^) , false alarm (P^,) , cross 

detection (P. ,.) and wrong time (P«,a ) are defined as follows, 
i/j 0/0^ 


Pp * Prob (i(lci 6) > tja = B, v, b ® 
p ® Prob (i(kj 0) > eja y 0, B “ 0, v * 0) 

■ Prob (i(k> 0) ^ 6|ct® i, B ~ j» 6, v, 0 ~ 0^) 
Pq^q « Prob (i(ki 0) > c|a » B, v, 0 ^ 0^) 


where a denotes the failure mode ti;at the GLR detector is based upon and 
B denotes the type of failure that actually occurs. Both a and B may take 
the values 1, 2, 3, or 4 representing the four modes of failures. The value 
of 0 for B i9 used for the case that no failure occurs. Also, 0^ is the 
true time of failure» 0 is the hypothesized time of faJlurei v is the true 
failure vector) and e is the threshold* 


Iim' 


I 

1 L..: 
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Thoro aro many asi^ecta to the evaluation of a detection scheme and 
a single index is not sufficient to indicate the quality of the scheme. 

The above probabilities are some convenient quantities defined in order to 
study some aspects of the GLR detector performance. is the confidence 
that one would have in the detector since it is tht probability of detecting 
a failure when a failure actually occurred. Pp measures the negative 
quality of the detector as it is the probability that a failure is signaled 
while no failure has occurred. Both P^^^ and Pg^p^ are more subtle measures 
of perfcmance. since they pertain to the ability of the detector to dis- 
tinguish fei lures of different types and different failure times respec- 
tively. 

Note that these probabilities are defined at each point In time 
assuming no knowledge of the Jl(k; 6) at other times. It is clear that 
jl(k» 6) and Jl(jf (|») are correlated whenever the intervals 16, k] and l<|), jl 
overlap, since the GLR detector operates over ranges of values of k and 6 
(both as real time and as hypothesized failure time vary) , a better set 
of performance measures might be "interval" versions of the probabilities 
defined earlier. For example, one might be interested in determining 
probabilities such as 

* prdb ()t(k»e) > e|a - 6, v, 6 « e^, «.(ji6) < e, 0 < j < k) 

This is the probability that we will first detect the tailure at time k 
an d is extreme ly «^£ul in evaluating delay time in detection. 

The modified probabilities require the joint densities of Ukt 0) 
and )l(j» <|>) which are difficult to confute in the full GLR case since 
correlated noncentral Chi squared (x^) random variables are involved. 
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However, in the Hiroplificd GLR case, A(ki 0) and 't(1» 4>) are jointly die- 
trlbutod gaussian random variables, and the study of the modified probabil- 
ities is easier in this case and hopefully will lead to a better under- 
standing of the full GLR. This study will Included in the next report. 

For the computation of the probabilities defined at the beginning 
of this section, the density functions of 0) under the stated condi- 

tions are required. It is shown in II. 1 that the full GLR is a noncentral 
random variable whUe the simplified GLR is a gaussian random variable 
(II. 2) . The computation of noncentral probabilities is considered in 
Ii,3. The noncentrality parameter (6^) of the x^ density and the mean of 
the guassian density of GLR systems reflect the effect of the failures 
on the JUki 0). In II.4, these parameters are examined under the condition 

of correct detection. 

II. 1 Full GLR probability density 

Consider a detector that hypothesizes a type i failure with failure 
time » 0 while an actual failure v of type j occurred at 0^. The actual 
residuals and GLR outputs then are given by 

Y(k) » YOt) + 

k 

d(k» 0 ) - 2 0)v“^(m)Y(m) 

m-0 ^ 

k 

ro »0 

JUk» 0) - d'(ki 0) 0/0^)d(k» 0) 


where 


G^(kf 9 ) l 8 the Cl matrix corresponding to a type j failure, Y(k) is tae 
unbiased, white part of the residual, and 

k 

C ..(k» 6/0) ■ S G!(n» 0)V"^(m) Gj^(m» 0) 
m -0 

Note that C^^^(k, 0/0) - C(k, 0) of a type i detector. 

Since v”^(ro) is a positive definite syrometrix matrix, 6/0) 

is positive semi-definite symmetric matrix. Then there exist an ortho- 
normal matrix T such that 

Ai/i(k» 0/0) - 6/0)T 

where ^ diagonal matrix and the diagonal elements are the 

eigenvalues X^, X^ ... X^ of C^^^(k, 6 / 0 ) (n is the dimension of 
Ci/i(ki 0/6 )). Assuming (ki 0/0) exists, define 

)l(k» 6 ) » {d'(ki e)T}{T“^C^^j^Ck?e/ 0 )THT“^d(ki 0 )) 

^ v' (k» e) ( 1 «» ©i) V (k» 62 > 

Then v(kj 0) is a guassian random vector: 

k 

v(k> 0 ) » t' 2 0 )v"^(m) lY(m) + G^(mi 0 ^)vl 

mf »6 

k 

B{v(k> 0 )} ■ t' ®4 (mi 0 )v"^(m)G.(m» 0 ^)v 
m -0 

^T'c^^^(k, 6/9^)v 
£{v(ki 6 )v'(kj 0 )} 

- T'C^/^(k|6/e)T + T*C^/^(k»6/0^)w‘^q/^(kf6/0^)T 

. A^^j^Cki 0/0) + lB{v(k»0)}nE{v(ki0))l’ 
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Honce A .. (k> 0/0) lo the covorianeo of v(kj 0), Since A^.^^Ckj 0/0) 
l/i 

Is diagonal, olementn of v(ki 0) are independent of one another. l(k» 0) 
can be exproanod aa the eumnation: 

A vl (k, 6) 

J,(k> 0) ” Zrf \ — — 
m»l m 

where v (k» 0) is the component of v(k; 0). Then each term in the 
m 

aJaove auwnation is the square of a gauss ian random variable with unit 

V 2 Oc; 6) _ 

variance and mean of (v^<k; 0) is the mean of v^(k, «)). 

n 

Therefore, A(kj 0) is a noncentral random variable with n degrees of 
freedom. The noncentrality parameter (6 ) can be shown to be 

6^ « lE{v(k; e)}l’A“J^^ (k, 0/0)tE{v(k, 0)}) 

= V C^/j(k; 0/0^) (k; 0/0) 0/0^)V 

Note that no assvimption is made on i, j, 0 and 0^. The derivation 
includes the conditions defining P^.# P^/j and Pq^q^ as special cases 
as well as others which are not considered presently. In any event, 

£(ki 0) is a noncentral x" random variable with n degrees of freedom and 
6^ dependent on the conditions hypothesised. Specializing to the four 
cases of current interest# we have# 

(1) p,j« e » i » i 

6^ • v' Cj^^^(ki0/e)\> 

(2) Pp* i » j, V - 0 
6^ = 0 

2 

£(ki 0) becomes a central x random variable 


-ll-- 


(U W 1. f' - \ 

* V* (k> 6/0) (ki 0)Cj^^^(k> 0/0) 

(4) t « j e ^ 0^ 

Note th&t the different relationships among Q, 0^, k have different 
physical meanings ^ for instance, 

< ®t - ® ) 

)« < 0 ^ 0^ > not meaningful 

0 < k < 0 / 

0 < k < 0 false alarm 

0 < 0 < k ) 

^ ~ ) wrong time 

0 < 0^ < k ) 

then 

6^ = v’ C’^i(k» 0/0^.)C^^j^(k, 0/0)C^^^(k|0/0^)v 

The probabilities (P^^, P^., P^^^, Pq^q ) are simply the integral of 
the density functions of J^(k? 0) from i = e to i * +*“. 

11,2 Simplified GLR probability density 

Consider a simplified GLR (SGLR) detector set to detect a failure 
of type i with failing time ® 0 while a true failure v of type j 
actually occurred at 0^* 

Y(k) - yik) + (k» 0^)v 


P,(ki 0) =. 2^ Ii!Y(m) - fi. (mi 0)v rv"^(m)n. (roi 0)v 

nrO 1 o to 

k 

* £ 2Y'(m)v'’^/m)G. (roi 0) 

A i O 

ro»0 

k 

+ 2 2 v’GiCmi 0. )v’^(m)G. (mi 0) 
m^e ^ ^ ^ ® 

k 

- V* ^ g' ( mi 0)v"^(ro)G. (mi 0)v ^ 

® »=0 ^ ^ ® 

k 

= 52 2 v' G|(mi 0)v”^(m)Y(m) 

O 1 

m«0 

+ 2 v’ c,,.(ki 0/0. )v - v' C. .. (ki 0/0)v 
o i/j t o i/l o 

Since Y(m) are zero mean, independent gaussicui random vectors, il(k; 6) 

— 2 

is a gaussian random variable with mean (i) emd variance (o ) : 

I - EU(ki 0)} = 2v^ Cj|^^^(ki 0/0^)v - C^/iOs» 0/0)v^ 

= B{()l(ki 0> - 
k 

■ 4 v’ X) G^(mi 0)v"^(m)G^(mi 0) 

® m=6 


- ''o '^o 


Kote that the variance is the same for all cases whereas the mean 
varies. For the four cases of interest! 

(1) Pjj! i » j, 0 = 0^, V = 


T • \> C, j. (ki 0/0)v 
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(2) Ppt i = j V * 0 

T » - V*C. ,, (kf0/0>V^ 
o x/i o 

(3) I j» V = V^, 0 = 0^ 

r- 2v^c^/.(k,0/0)v . 

= '"“ V 

0 < 0^ < k or 

0 < 0 < k 

t 

^ “ 2v;c^/^(k,0/0^)v - v;c^/^(k, 0/0)V^ 

Another probability of cross detection “®y defined for 

the simplified GLR. 

P^/i(V): i » jr 0 » 0^.» V ^ 

I = v'C. ,.(kj0/0) [2V - V J 

simplified GLR is polarized to detect a special failure direction. 
provides a measure of the ability of sinplified GLR to detect other 
failure directions than the hypothesized one (V^) . This quantity can also 
be used as a measure of the distinguishability of different failure 
directions for a simplified GLR detector. Given the basic similarity 
of the GLR and SGLR algorithms, these calculations should shed light on 

the properties of full GLR. 

The desired probabilities are easily obtained by integrating 


. ! 



h 








gaussian distributions 
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11,3 The random variable 

A. The central random variable u with n degrees of freedom is 
the sum of squares of n independent « zero mean » unit variance gaussian 
random variables or more precisely r 



when N(0, 1) 

and eCxj^x^} “0, i j. 

Then the density function of u is : 


f"(u) 

u 


! 


1 

2"/^ r(i n) 
0 



n 

2 

u 


1 


u > 0 


u < 0 


where r(0 is the gamma function. 

There is a FORTRAN subroutine (CDTR) in the IBM Scientific Sub- 
routine Package that can be readily used to compute the integral of the 
above density# the quantity 

p "^(tt < e) “ f fJJ(u)du » f f”(u)du 

^ o/mOO •'O 

Then the false alarm probability of a detector set to detect a 
£ail\u:e in an n-dimensional system is 

P_ - 1 - p“(u < e). 

P u *” 

B, The noncentral random variabits: (O with n degrees of freedom 
is the sum of squares of n Independent# nonzero mean# unit variance 

r andom variables with the noncentrality parameter defined as 


The density for a> is 


il^^h d *■ 0 f u) is A centr si X • 


f” j(u) 

u,« ij* 


, . ^ -f («^<-)^ nj*!' 

I ^ e ^ w 1 ^ 

( 2 j)! r<j+jn) 


1 


W > 0 
0) < 0 


Recall 


r(i) «/ir 


Then 


f" 2^“^ “ ® 

a>,5 


1.2 ~ 2=2^4 

XT' 2 ^ 

^ 2-» <6 “ ® 


r(j + j) 


12®® 

j»0 


^^0 2"/^ r(|)(2j)l r(jn+j) 

^j-1 (j-i-** o~2-»^ •»» 2 

* ® 2*''^^(2jyi r(j) r(j-f|.n) 


w > 6 


1.2 * !Lm_ 1 io) 2"^(2j-l) (2j-3),..(3) (l)r(y) 

^ 2 -i 2^^ ■'■ - ^ 

3 2 2^ isW e -IT 


j-0 


2^2j) (2j-l) (2j-2) (2j-3) .. (3) (2) (l)r(j)r(j4 «> 


1.2 • 


^ 0, 


|fj-l -|u 


1x2 • 


. D ifil 


2J 


j-0 2^jl 


hence I 


p*‘ - (w < e) « 

w,6^ 


e 2 2- — ^ C 

j-0 ^ 


(u < 6) way be computed using the IBM subroutine CDTR. Then 


p*' ,(w < C) is calculated by j^orforming the summation. The infinite 

«,6- “ 

sequence in the expresHion of P*' 2 ^*** i Proved to be convergent. 

2 “>r* 

For wide ranges of 6^ and t, the limit of the series is effectively 
attained by summing less than thirty terms. We also note t^at 

lim p" 2 1 ^ ° 

e 09 40^6^ “ 

lim p" 2 i “ 0- 0 < £ < « 


6 ^ -► 09 


uj,6‘ 


Hence. P , P. and P« .« are increasing functions of 6 and approach 1 
D' x/j 0/6^ 

as 6^ goes to " for any finite value of e, the threshold (at- Figure 2.1), 

11,4 A study of the probability of correct detection (P ^) 

Hecall for full OLR, 

P = Prob(i(ki 0)> £|a = 3 “ i, 6 » 0^) 

D c 

2 

Under this condition, JL(k; 0) is a noncentral x random variable with 

2 

noncentrality parameter 6 . 

6^ = V* (kj 0/0) V 

By the definition 

Ci/i(k; 0/0) - C(k» 0) of the type i detector 


Then 


6 « V* Cx.v» 0)v 


For simplified GLR, 

Pjj - Prob U(k> 0) > e|a » 3 * i» 0 « 0^ » v « v^) 

2 

i(kf 6) is then a gausslan random variable with mean (7) and variance (0 ) 


PROBABILITY (2 DIMENSIONAL FAILURES) 
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T = V* C(k» 0)v 
- 4 I 

2 ** 

In both cases, the P^'s are increasing functions of 6 an4 Jt which 
evolve with time (k). An understanding of the evolution of the Pj^'s 
requires the evolution of 6^ and T which in trun require the behavior of 
C(k) 6) as a function of time. 

In the following, we present an analysis of the behavior of C(k; 6) 

for time invariant sys' terns, . 

In a time invariant system and ste dj —state Kalman filter, C(k; 6) 
becomes dependent c,. the difference between the true failing time and 
observation time (k- 0). For convenience, we let r » k - 0. The four 

different types of detector are considered separately. _ 

1. State Jump Detector 

r . 

F(r) » 2 

j-0 

where 0 * K is the steady state Kalman gain, ♦ is the system 

matrix and H is the observation matrix. Both the system and the filter 
are assumed to be stable. Then the magnitude of the eigenvalues of ♦ 
and 0 is strictly less than 1, i.e. 

I < 1 i - 1, 2, ... n 

|X^(0) I < 1 i - 1, 2, ... n 

where n is the dimension of 4 and ©. Consider the norm j | * 1 1 of a nxm 

matrix A, ^ 

||a|| - max <x'A*Ax)^'^^ 

||x||.l ~j 

V 

1 

I 


where x is a m-vector. 


For a nquanJ matrix A with all eigenvalues of magnitudes less tha'» 

it can be shov^n that Ha|| < 1. 

For a jump in the states 
r 

P(r) » £ 
j-0 

r r 

jlF(r)|| < S P*" “ l|KHll (r+l) P*" 

" j-0 j-0 

where p - max { | !♦! I » I 1©I I ^ 

Since p < 1» there exist a a > 0 such that p » e • Then 
|lF{r)|l 1 IIkhH (r+1) 

The FHS goes to aero as r -*• *. Therefore 
lim P(r) =0 

j- -► 00 

Similarly, for G(r) , 

||G(r)|| = ||hW' - ♦P(r-l)lll 

< l|H||t|l*ir + 1 1*1 1 ||F<r-lHll 

< 11h| 1 Ip' + IlKHjj r p'l 

Hence G(r) also approaches aero as r Now consider c(r). Define 

dc<r,s) - C(rl - C(s) , r < 8 

s 

« £ GMj) v“^G(j) 
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{ |AC(r«s) 



IIhII^ Ip^ + IIkh'iI jp^l 


< llv’^ll ||h||^ [(s-r)p' + IIkhII (8-r) + p'l 


As r the terms in the bracket approach 0. Hence 

lim ||AC(r,s)|| =0 r < s 

■|p -► 00 • 

This shows the {c(D, C(2), ... C(r) ...} is a Cauchy sequence and hence 
conv 6 r 968 to & finite constont metrix« Noting that C has the interpretation 
as the Information matrix associated with estimating we see that there 
is a finite amount of information concerning V in the residuals y (this is 
clear since both the systi^v and filter are stable and the failure is a 
transient effect — i#e.f a jump)# By determining tlie rate of convergence 
of C (r) f we can choose a waiting time r^ such that there is essentially 
no information in y(k) concerning failures at time 6, where k - 9 > r*. 



S o'"^ KHll - ♦!" 
lx - II - 01*^ 
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As r the first term becomes [I - 0) ^KHti " *H and the second goes 

to 0 following the reasoning for the nt.ite jump car«. (I - OJ ^ and [I - ^ 

exist because |Xj^(0)| < 1, |Xj^(4>)| < 1 1 » 1» 2, ,..n. 


G(r) » Hi 


^ - 4»F(r-l)l 


= Hll - - H*F(r-l) 

As r •*• *» the first term becomes Hll 41 ^ emd the second, hUT-OJ ^KHll-^] • 
Hence G(r) reaches a constant as r G'(j)v G(j) is positive semi- 

definite and attains a steady state value G' (*)v ^G(“). Thus it is possible 
that some of the eigenvalues of C(r) grow as r increases indicating that 

failure vectors w .1 cause a growing 6 » Therefore, an actual failure 
vector of this nature will cause to approach 1 as the waiting time (r) 
increases. By examining the eigenvectors and eigenvalues of C, we can 
determine those step failures that can be detected with arbitrarily high 
probability if we are willing to wait long enough. 


3. JuB^ in sensor 

lim Fir) = lim = 0 

lim Glr) - lim -H*P(r-U - 0 

r 00 r 

Hence C(r) for sensor jump failures behaves much like that of state jump 
failure. 

4. Step in sensor 



lim P(r) ■ lim 
r « r * 


11 - 01 "^K 


lira G(r) ® lim U - H4»F(r-l)J 
I*. 00 r 

» I - H*(i - ©r^K 


Hence C(r) for sensor step failure behaves like that of state step failures. 

In general, C(r) is a sum of positive semi-definite matrices and 
ronsequently may be positive definite or semi-definie matrix. If C(r) 
is positive semi-definite, then there are failure vectors such that the 
resulting 6^ is zero, Implying the failure direction cannot be seen by the 
detector and that certain failure directions are indistinguishable. Intui- 
tively, one would suspect the cause for tliis is that this failure direction 
is not observable. This is true in fact, la the following, conditions 
for the pbsitive definiteness of C(r) of different detectors are derived. 

C(r) may be written as 


C(r) = 


[ 


G'(0) : G*(l) 

e 



G(0) 

• • • 

G(l) 

e e e 
e 
e 

e e e 

G(r) 


« G* (r) v"^ G(r) 

Since v“^ >0, v“^ > 0. Prom the theory of linear algebra, C(r) is 
pMltlv. 4.flnlt. if th. null ««c. o, 0(r) 1. (o). «. exmin. Clr) for 
the four cases separately. 


1. Jump in State 


G(r) - 


1 

-H«K 

-H«0K 


I 

-H«K 


0 

I 





Aj^(r) B(r) 


A, (r) Is a lower trlanqular matrix with identiy blocks in the diagonal. A.(c) 
1 * 

is of full rank, and the null space of G(r) is the null space of B(r). Hence 
if the null space of B(r) is (o), C(r) is positive definite. This condition 
on ^ exactly ti»e observability condition of the system in r steps. 

2. Step in State 


I 


H 

0 



I-H^K I 



1 a 

1-H* 53 0^K I-H*K I 


SB 

j=0 



s 

s 

s 


s 

s 

s 

r-1 . ^2 

1-h4 ^ O^K I-H* X) . . • I 



jasO j®0 




« AjU) B(r) 

A 2 (r) is of full rank. C(r) is positive definite if the system is observable 
in r steps. 

3. Jump in sensor 

6(0) ■ G'(0) •* 1 

Hence the null space of 6(r) is always to). C(r) is always positive 
definite in this case. 

4. Step in sensor 

Similar to sensor jump failures. 

6(0) - G'(0) « 1 


C(r) is always positive definite In the sensor step case. 



Qyntm observability makes a state failure detector sennit I vo to 
all directionn of failure by eaufllng a nonzero B . Bensor failures are 
directly observable and hence 6^ for sensor failures is always nonzero. 

{2 ^^^alns finite steady state values for all jump failures. While for 
step failure, some failure directions may cause a constant, steady-state 
rate of Increase in 6^. A finite steady-state 6^ gives a limiting value 
of Pp {< 1) I an increasing 6^ allows one to choose a P^^ arbitrarily close 
to 1 by waiting long enough. 

Ihejabove analysis also provides guidelines for selecting window 

sizes. For detecting jump failures, the window does not have to be large 
since excessive waiting time (large r) does not increase Pj^ after a 
certain stage. A long window is appropriate in detecting small step 
failures. If ^e system of concern is not immediately observable, i.e. 
the null space of the B(r) matrix becomes {o} for some r > 0, the detec- 
tion test should not be performed until the system at 6 becomes observable 
from k, the present time. That is, in general we will calculate i(ki 0) 
over an interval of the form 
jt-M^0<k-N 

where N is chosen by observability considerations, while M is chosen by 
the limiting behavior of P_ and by computational considerations. 



ni. The Test Problem to be Conaldered - The Two-Plmenslonal Longitudinal 
Dyhamics of the F-8 

III, I Introduction 

Some simulation results have been obtained on the performance of 
the GLR (qeneralized likelihood ratio) detector for the first four failure 
types: ju.nps and steps in the state, and jumps and steps in the sensors. 
The detector equations for these failures were implemented with a simula- 
tion of a reduced-order (2nd order) P-8 aircraft model for a range of 
failure magnitudes and directions in state space. 

The purpose in doing this was to get some experience with the GLR 
approach to failure detection. Having some sample performances of the 
detectors provides insight in a way that helpo. formulation of meaningful 
questions for further research on GLR failure detection. 

Section II1.2 states in general form what the GLR approach to 
failure detection is based on. Section III. 3 describes the second-order 
model used in the simulations and section III. 4 presents the steady state 
Kalman filter designed for that model. In section I II. 5 the relevant 
equations of the detector are shown and section 111.6 describes what the 
different failures co n si d ered are and what they represent or model in a 
physical system. 

111,2 Generalized_Li)celiliood_Ratio_Aggroac^ 

Briefly, the GLR approach is as follows. There are two kinds of 
hypotheses t 

H t no failure has occurred 
o 

failure of type i has occurred. 


If r ’o m failure inodeR, there are mtl hyppthofietn 

Th® filter anrt controller are dealgneii baaml on 11^. can then 

compute the effect that" the varioue fallureo considered have on the filter 
reeiduela. We then havei 
**o* 

X<lt> • £<>«> ♦ 

where 

^(k) = z(k) - Hx(lc|k-l)r the residuals from the Kalman filter 
V =* failure vector 

m-m 

G^(ki 0) “ failure 'signature* matrix for the effect of a 
failure of type i at time 0 on the residuals at 
time k. It is preconqputable for each i. 

Using these computations we can perform hypothesis tests on the residuals 
to 

i) determine if a failure has occurred 

ii) identify the failure type, i 

iii) estimate the size of the failure. 

Schematically 






Ill, 3 Svatom Model 


The simulations %»ere made using a second order discretized version 
of the longitudinal dynamics for the-J*^B aircraft at flight condition 11: 
altitude ■ 20,000 ft,, Mach No, » 0,6, cumulus clouds. 

The motivation for using this model lies in the need to have a model 
of a concrete, physical system on which to try out the detectors that 
would provide some coimon grounds for comparisons. Furthermore the model 
lurovldes a compromise in complexity between realism on the one hand and 
the amount of computation and ease of interpretation on the other. In this 
early phase ot research on the GLR approach to failure detection some 
results were needed in order to understand its structure and performance 
characteristics. It was felt that a system of higher order would not 

add significantly to our understanding. 

Our model is derived from the longitudinal dynamics of the F-8 linear- 
ized ^ut flight condition 11. That model is 7-dimensional with the 
following state variables: 


^x(t) = A x(t) + Bu(t) + C(t) 

(7x1) (7x7) (7x1) (7x1) (1x1) (7x1) (Ixl) 

(rad, /sec) 

* g, pitch rate ..•••••••• -••••• 

Xj ■ V, velocity - tv^ “ Mach no, x speed of sound! , . . (ft/sec) 

X- - a, angle of attack - trim value (rad,) 

■ 6, pitch attitude 

X, “ 5 , elevator deflection - trim value ...» <«d.) 

5 e 

X, “ 6- , commanded elevator angle ..... (rad.) 

Xy • w, normalized wind disturbance . (rad.) 


The control variable 1st 


u(t) . 

c 

h, B, and L are constant matrices whose dimensions are indicated. 

State variables - 6^ and Xg - 6^^ account for the dynamics of 

the actuators and x, « w is the output of a first-order linear system 
driven by white noise. w(t) models a wind disturbance with powdr 


derisity given by: 



For flight condition 11 ve have: 

L = 2,500 ft. 

V » (0.6) (1,036.93 ft/sec) » 622.150 ft/sec 
o 

0 * 15 ft/ sec (cumulus clouds) 


The five sensor measurements z_(t) are given by: 

z(t) = C x(t) ♦ 0(t) 

(5x1) (5x7) (7x1) (5x1) 

z > z , pitch rate measxirement 

1 <J 

z. ■ z , velocity error measurement 

2 v' 

»-» - Zft, pitch attitude measurement 

3 6 

* ■ z. , elevator angle measurement 

4 «e 

8 ■ 8 , normal acceleration measurement 

5 ®Z 
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C is a constant (5x7) matrix and 0 is the vector of measurement noises, 
which are white and mutually independent. For more information on the 
model see [1] . 

Some of the steps taken in the reduction of the order of th'i. model 

vreret 

- ignoring the input dynamics represented by Xg and x^ as they 
are not the main variables of interest in an aircraft dynamics 
model. 

- eliminating x^, the wind disturbance, as a variable and modelling 
its effects on the remaining ones by a white noise process. 

- selecting the variables with highest signal-to-noise ratios 
among the observations and ignoring the rest. 

- using comnon sense and engineering intuition to correct and/or 
add for any other significant interactions. 

The resulting model is a two-dimensional representation of the 
dynamics with the new state variables: 

" q» the pitch rate 

Xj ■ (angle of attack) - (trim value) 

The last step was obtaining the corresponding discrete-tine model 
in order to simplify implementation on the digital computer. The dls- 
oretising time step was T ■ 0,03125 see (^ sec) . The result, 

x(k4l) ■ ♦ x(k) + w(k) 

(2x2) 72iT2) 

s (k) » H x(k) + Gjjjj v(k) 

(2x2) (^) 


( 2 ) 


vAtere 


_ (0 

k ^ j 

E(u(k) w(j)^} * 1 ' ^kj "K 

e{ v(k) v(j)^)- I, 

k = j 

fO.98258 -0.146491 


Lo. 030587 0.97193J 



The eigenvalues of £ are: 

V- “ .977 + j (0.0667) , 1 - 1,2 




[ 0.022596 
0.0043276 

[ 0.008729834 

0.0 


0.0 

0.0002260: 

0.0 
0.06 


‘ 1.0 0.0 

_0.0 16.154 


m.4 Filter 

The filter linplemented was a steady-state Kalman filter designed for 
the two-dimensional model under normal circumstances (hypothesis H^) : 

predlctloni x(k|k-l> = (k-l|k-l> 

update t x(k|k) - x(klk-l) + (k) 

residuals t ]^(k) - s^(k) ^ H x (k|k-l) 

I T -1 

steady-state Kalman gain: K - P(k(k-1) H V 


with 
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where P(klk-l) = e( I x(k)-x(k|k-l) 1 lx(k)-x(k|k-l) 1^) 
V ■ YCk)***) 

- H P(klk-1)H^ + ®MZ 


In this example, we have: 


5351 X 10 


3527 X 10 


“ t 

h.< 

P(klk-l) » 

L^- 

V » I 

L^- 


-1 


4.6257 X 10 


-2 


-1 


1.2748 X 10 


-2 


6311 X 10 


-4 


0891 X 10 
-4 


-4 


393264579 x 10 
759328799 x 10 


-3 


1.0891 X 10 
2.2130 X 10“* 

1.759328799 x 
9.374701305 x 


] 

:r-l 


III. 5 Detector 

We now take a look at the detector and some of the computation 
involved in its implementation. For a more complete derivation see 121. 

Consider a particular type of failure, i, ar.d let k be the current 
time. For each 6e{k-M, k-N>, corresponding to tiroes inside a 'window* 

{to which we restrict the GLR to avoid a computation load which would 
otherwise grow indefinitely with k) , we compute 

k 

d<ki 6) • 2 8)\T^(j) i(j) 

j-0 


Which then gives the likelihood ratios 

JUki 0) “ d'*^(k» 0) 0)d(k» 0) , 0 “ h-M, k-M+1# k-N 


tdiere 
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k 

C. (ki 6) ■ 52 k-M+l, ..** k-N 

j=0 ^ - -1 

In our case some of these quantities are time- invariant so G^(k» 6), 
V(k), C^(kf 0) become G^(k-0), V, C^(k- 0). C^(k, 0) may be interpreted 

as the information matrix at time k for a failure of type i which occurred 
at time 0. 

Detection is decided by means of the decision rule* 

failure 
f(k; 0(k)) ^ e 

no failure 

where 0(k) is the MLF. (maximum likelihood estimate) at time k of the time 
of failure 0. It is taken to be the value of 0c(k-M, ...» k-N) for which 
Jl(k» 0) is largest. The detection threshold, e, is a design parameter to 
be considered in evaluating system performance. More will be said on this 
in section V.S. 

If it is decided that there is a failure, the estimate of the 
failure is given by 

V(k) -C‘^(k» 0(k))d(ki 0(k)) 

The windows used in the simulations, Ik-M, k-Nl, had N«0 for all 
cases, M-IO for jump failures and M-30 for step failures. 

111.6 The Failures 

The failure modes considered correspond to the four types studied 


so fart 


i 


-.u»- 

1) state Jumps 

x(k+l) = i x(k) + G + V 

2) State Steps 

x(k+l) » ♦ x(k) + Gjjjj w (k) + V 

3) Sensor Jumps 

z(k) = H x(k) + Gjjjj v(k) + iL 

4) Sensor Steps 

2(k) • * ®NZ - ■*■ - ®k,0 

We did not Include the control term in the state equations since 
w. are not con.ia.rln 3 elo.»l-loop .y.t.M M thl. point. For open-loop 
control nothing oould ohang. .. far a. th. a.t.otor 1. coneornrt, .ino. 
the Kalman Filter eguatlon. mould Incorporate the control term and Its 

effect is cauicelled. 

Failures were taken in orthogonal directions in failure space, 

(V^, 0) and (0, v^), for a range of v^, thought to be of most interest 

Let us take a closer look at the failures we are co*iaidering and the 
situations they might model in a physical system, in our case the F-8 

aircraft at the specified flight condition, 

consider an open-loop system and observation process, e.g., the 

one presented in section II1.3 by equations (1) and (2) t 
x(k+l) - i x(k) + B u + Gjjjj « 

( 2 ) 

£(k) ■ H, x(k> ♦ Gjjg V 

and consider the 4 basic "failure modes" described in Section It 


ly State jump 


ii) 


State step 


ill) Sensor jump 
Iv) Sensor step 

Keeping the system equations, (1) and (2), In mind, we can say a 
few things about (i) - (ii). Let us examine these failures in order to 
provide some (albeit superficial) physical motivation for the various 
modes. Recall that is q and Xj is a. Thus a state juinp of the form 
0)^ or a state step of the form (0, Vj) might be used to model the 
effect of a sudden wind shear that leads to an increasing angle of attack. 

On the other hand, a jump of the form (0, Vj)^ could be used to model a 
relatively long-term upward or downward gust that initially manifests 
itself as a shift in a. A step of the type (v^, 0)*^ could arise from an 
elevator failure. 

In the observation equation, cases (iii) and (iv), we have a similar 
situation. A failure v = (Vj^, O)"** may model a bad data point in the mea- 
surement of q in the jump case, (iii), or a permanent bias for the step 

case, (iv), in the ssmie signal due to a component failure in a sensor. 

T 

By analogy the same may be said about a failure V “ (0, Vj) »diich then 
refers to the measur^ncnt of a. 

Table 3.1, sumnarlzes the failure schedule implemented in the 
simulations. State and sensor failure magnitudes are given in terms of 
a- levels of plant and sensor noises respectively. For jump failures nothing 
under lo was looked at since such jumps would be undistinguishable from the 
rtoise. Such failure magnitudes were considered for step failures since 
they are detectable because their sustained presence provides more infor- 
mation as time passes. We will see how this is reflected in the GLR's when 


we take a closeir look at the Gj^(ki 0) for each type of failure* 
The 0*8 are the following t 


V \ —2 

, pitch ratei O : Plant Noise Level = 2,2596 x 10 

0 ) ** -3 

a ' : Sensor Noise Level = 8,7298 x 10 

q 



0 \ -3 

, angle of attack » Plant Noise Level <= 4,3335 x 10 


o * t Sensor Noise Level » 6,0000x10 

a 


.^2 






-37- 


IV, Application to tho Second Order F-8 Model ■ Full GLR 

The graphs in Fig. 4.1 and 4.2 represent a way of using and Pp 
togetiier. For a particular step failure and a threshold, the graphs 
provide the necessary waiting time (k - 0) for Pj^ to reach the values of 
,95 and .99, The failure size is measured in units of standard deviation 
of the noise (lo » 1 standard deviation) . F^ch threshold has a fixed 
value of P_ associated with it. The threshold values 5, 9, and 14 con- 

sidered here have P_*s of .1, .01 and .001 respectively. For example, 

F 

consider a .10 step failure in the pitch rate. To reach a P^^ of .99 with 
Pp of .01, a waiting time of 36 steps is required. Each time step is 
1/32 second. The waiting time may be taken as a measure of the speed of 
detection with a fixed rate of false alarms. 

It is evident from the graph that the full GLR detector is very 
fast in detecting state step failure of sizes ranging from .lo to 5a. For 
the sole purpose of detection (no estimation of v) , a small window of 
about 50 time steps is sufficient. 

Sensor failures require much longer waiting times, as high as 6.6 
hours for a .lo step in the angle of attack deviation sensor. This 
phenomenon may be explained by the nature of the associated G matrices (see 
Figures 5.2 and 5.3 in Section V). The entries in the G matrices are 
small in comparison with the G matrices of state step failure resulting 
in a small and slew growing 4^. Therefore, the window of a sensor step 
detector should be large. Its size would depend on the sizes a.ii direction 
of failure of interest. 

Waiting time plots are not made for jump failures due to the 
following observation. For jump failures, P^ either reaches the desired 
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value (.95. .99, etc.) in a tow Stepo or It never reaehen It. This, however, 

la in agreement with the previous analysis. The effect of a Jump failure 

decays as time progresses tihus creating a approaching a constant steady 

2 

state value. For a fixed threshold, this value of 6 corresponds to a 

fixed value of which may be bigger or smaller than the desired Pjj. 

Therefore, j^unp detector windows should be small since large windows do 

not necessarily improve detection. 

We note that all of these quantities are static quantities ~ i.e., 

t and P calculated here are simply the probability that i(k» 8) > e for 
I D 

fixed )c - 6. These numbers should be interpreted as follows: 

1) Fix k - 9 ® r^. We are looking only for failures at the 
time 0 = k - r^, and thus at any time k we need only evaluate 
one likelihood ratio, ll(k» k - Tq) , using the window of 
residuals y(k “ rQ) » Y(k - r^ + 1), ...» Y(k). 

2) The numbers P_ and P_ in the figures are the probabilities 

that 

Jl(kj k - r^) > e 

under the failure (of size v) and no failure hypotheses, 
respectively. 

Note however that the given window of residuals can be used to 
calculate other values of Jl(k{ 0) with 
k - r^ < 0 £ k 

One ca n then consider questions such as the following: suppose we wish 

to detect failures anywhere in the interval (k - i-q» kl i suppose we 
define the detection rule: 
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Declare failure in the interval [k - kl if K of the 
likelihood ratio Ukt 0), 0elk - r^, kl exceed a given 
threshold e. 

By using more of the data over an interval, such as in this detection rule, 
we would expect better detection performance— i.e. by taking K > 1, we 
can reduce P^., since the effect of one bad data point is somewhat alleviated; 
on the other hand, by looking at more than one of the i(k; 0), we should 
increase the probability of detecting failures. Howciver, the calculation 
of P 's and P 's for such decision rules, considerations of the values 
of M, e, r^ and the number of Kk; 0) to be evaluated in the interval are 
difficult since the i's are correlated non-central x variables. As 
mentioned earlier, the situation is somewhat better in the SGLR case, and we 
plan to consider this in the near future. 


V. Simulation Roaulta 



V.l. Introduction 

The results which the simulations present are rich in content. However, 
there seems to be so imich information in them that full appreciation of it all 
will take some time and much study of the data. Consequently, a simple physical 
model must be used in this initial stage until we understand better the limi- 
tations in detector performamce. Added degrees of freedom at this point would 

increase the difficulty of interpretation significantly. 

In the following sections "e take a look at these restilts. As a first 
attempt at organizing them we will comment on the overall behavior of the 
detectors in section V.2. Then we narrow our perspectives to try to draw some 
conclusions, in section V.3 we focus on jump failures, both in the state and 
sensor equations and in V.4 we do the same for both kinds of step failures. 
Section V.5 considers the problem of false alams and the sensitivity of de- 
tection to changes in the threshold. In section V.6 we take a look at the 
elements of G^{k»6), the failure signatures and some interesting differences 
in detection performance for failures in the pitch rate and angle of attack 
directions with some physical interpretation are seen in V.7. 

It is hoped that the qualitative descriptions and physical interpretations 
of the detector behavior show why the GLR approach makes sense. All this will 
provide a useful evaluation of the GLR detectors as well as of our under- 
standing of it to date. These results should suggest the next steps to be 


taken. 
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All the simulations were done with the corresponding detector for each 
type of failure, i.e. for a failure of type i the detector implemented is 
based on Gj^(kj0), (a different problem is that of cross-detection: looking 

for a failure of type i with a detector based on Gj(kj0) with j?*). The 
decision threshold was fixed at the value e=5 all throughout and window sizes 
were IM«10, N»0] for jump detectors and lM=30, N=0] for step detectors. All 
failures occurred at k*5«0^, and the simulations ran five time units past 
the moment when 0^» the true time of failure, left the window. Recall, the 
window at time k is composed of (k-M, k-M+l,,.,,k-N-l, k-N>. Therefore the 
simulation stopped at k»M+0^+5»M+lO, or k«20 for jumps and k»40 for steps. 

The flowgraph in Figure 5,1 illustrates the general make-up of the simulations. 



. — , — 
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The system and filter matrices, threshold e, failure time 0^, window 
size M,N and failure are specified at the beginning of a run. Then the 
detector matrices G(kj0), C(k;0) are computed. At everytime k during the 
simulation an observation Z(k) is produced which results in its corres- 
ponding filter residual Y(k). For every 0 in the window specified d(k;0) 

is confuted and 

6 m arg meucKk; 0) 

is selected. Using this estimate of the time of failure, an estimate of 
the failure is then computed using d(kf6(k)) and C (k;§(k)) with the 
equations presented in section 1H,5. This procedure is repeated again 
for k+1 until the final time is reached. 

y^2 Descri pt^ion of siniulatiion resujji^ 

Here we provide a brief qualitative description of the detector 
formance for the different failures considered. Recall the decision rule 

at time k. 

Detection when maxi(k|0)^C=5.O, 0e(k-M,... 

0 

The set of simulations consisted of failures of the four types presented 
in Section I1I.6 for the range of values shown in Table 3.1. For each case 
two runs were made, each with different noise sequences for the process and 
measurement noises. Although two runs do not provide statistically signi- 
ficant results, they do allow us to avoid some unjustified generalizations 


I 

I 


based on a single set of data. Some of the simulation outputs are presented 
in sections V.3, V.4 and V.5. 

We begin with a description of the results for the case of state 
failures. 


Jumps: 


Id . . 4 


. Small delay of 2-4 time steps sec - sec.) before detection 
of pitch rate failures, (v,0)'^; detection is immediate in the 
angle of attack direction. The estimation of the value of v is 
erratic. When 0^, the true time of failure, leaves the window, 
even detection itself degrades as it becomes more sensitive to the 

noise. 

.. Detection is immediate in all cases seen. We will see in section 
V.5 that this remains true even for threshold at least as high as 
e= 14. Correct identification of 6^ takes place, especially for 

A 

the larger failure magnitudes, lOo and 20o. The estimates v 
are less erratic although the best estimate is attained in a few 
time steps (<5) with no further improvement. Estimates degrade 
rapidly as soon as 0^ leaves the window. 


Steps t 
l/lOd .. 


, Detection takes place, although it is somewhat erratic: it may 

be lost for varying lengths of time. While not very accurately 
or consistently, the fact that a failure has occured can be 
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1/20 . 


10 ... 


So • 


ascertained. The simulations indicate some sensitivity of detec- 
tion to the noise processes in the system: one run showed delays 

(3 a nd 13 time steps) in detection while the other one showed no 
delays. The larger delay is in the a direction, the angle of 
attack. The estimated time of failure varies and the failure 
estimates are not close to the true failures. 

. Detection is fast* largest delay was 5 time steps. Apparent sen- 
sitivity to noise in detection because for one run detection was 
inmediate. Also, no significant difference is seen in delays to 
detection for failures in q and a. The estimate 0 of failure 
time goes through a small transient and settles near 6^ (+1 or 2) 
The failure estimate is slightly more accurate than for •jg ® 
failures but it degrades rapidly as k increases, 

, Detection is very fast: either immediate or with a delay of 1 

time step for failures in both q and a. The estimates § are 
correct and show improved accuracy in v over 1/20 failures, 
mainly for failures in q. (v,0)'^. Best estimate v, reached 
after approximately 15-20 time steps with slow degradation 
thereafter. 

.. Detection is excellent: it takes place without any delays for 

failures in both directions, q and v. The estimate 6 goes to 
0^ very quickly and the estimation accuracy in V increased 
significantly over the previous cases (l/lOO to 10 steps). Por 


example, the estimate of the non-zero element of V 

(V “V for q and V -V, for a) comes within 5-10% of the true 
i 1 I ^ 

value and |^ij»l^ol' ^0 estimate of the other 

element of ^ (true value is zero). 

Before going on to the sensor failures let us note a few things. First 
of all, since one time step in this model is 1/32 sec., a delay in detection 
of 8 time steps, for example, represents in real time a delay of 0.25 sec. 
Delays must therefore be fairly long and errors in t must be fairly large 

in order for them to be significant* 

H«t a on the accuracy of the failure estiMtes. It can be 

•ho»n that c'^k.e) ha. the interpretation of beiny the covari«>ce natrix 
of the error in the estimate V. In Figures 5.2 and 5.3 we have plotted 
the elements of C*''(kie) for the oases of state jumps and state steps for 
our model. Hote that for jumps steady state value are reached almost 
immediately. This mem.s that for this type of failure the estimate obtained 
Initially, after a few time steps, is as good as we can expect to obtain. 
Alternatively, for state steps we note from Figure 5.3 that if one waits 20 
time step. (5/8 sec.) our confidence in the estimate increases considerably, 
This is bom. out by the simulation results. Figures 5.4 <u.d 5.5 are 
plot, of the estimate in the phase plwie for state jumps and step, of 
magnitude 10 and 5o. hot. that the estimate in the jump case, results in 
greater error Mid does not improve significantly with time. In contrast to 









Fig. 5.5 Pho$e Plane Plot of the Estimate: 50* State Failures 
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this we see that for stops the estimates gradually approach the true values. 
We now take a look at the sensor failures. 

Junqpst 

10* ... Detection is immediate and is maintaLied while 0^ remains inside 

the window. As soon as 6^ leaves the window, detection beccmes 

erratic. The estimate 0 is very sensitive to noise even while 

0 is in the window. Also, the estimate ^ is not very accurate 
T 

although there is some improvement while 0^ remains in the window 
50* .«♦ Detection is quick t immediate in most cases, a delay of 5. time 

steps showing up in one sample run for a q failure. Otherwise, 
no significant improvement in performance over the above lo case 
except for slightly more accurate estimation of V. 

>10o* ... Detection is excellent: immediate in all runs except for one, 

A 

with a delay of one time step, in q. In estimation, 0 is 
correct and the failure estimates 0 are much more accurate 
especially for angle of attack failures. For exang>le, for a 
failure in a, (OjVj)*, of magnitude 20o' the estimato 

2^ - is such that Vj is within 5% of the true value 

with jVjj comparison, the estimates for a failure 

in q, are such that Vj^ is within 25% of the true value 

and with |0j^j • jOjI. 



I 
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Steps t 

l/lOO' Detection is excellent, it is immediate for failures in both 

q and a. The estimate 8 is very sensitive to noise and the 
failure estimate V is very erratic, 

X/2o* • • , Performance of detectors is similar to the above for l/lOO . 

detection is immediate with I responding to noise. Slight 
improvement in estimating 

10* ...... immediate detection. Some improvement over l/lOo* and 1/20* 

failures in the estimation of v. 

50 I Generally very good performance* immediate detection except 

for one run for a failure in q. The estimate 6 is very close 

to 0 and the estimates of the failures show significant 
T 

improvement over the above cases. 

>l0o* ... Very good detection in general. Detection is immediate in all 
cases except for a run with a delay of one time step for a 
failure in q. The estimate 0 goes quickly to 0^1. The 
failure estimates are relatively accurate: within 5% of true 

value, although they degrade gradually after 0 ^ leaves the 
window. Results are better for the larger failure magnitudes. 

Once again let us make some remarks. Figure 5.6 is a plot of C (k»0) 
for the case of sensor jumps. Me see that our confidence in the estimate, 
inversely proportional to c“^(k|0), does not improve noticeably after the 
initial time step. In contrast to this, in Figure 5.7 C (k»0) is plotted 










JUMP IN SENSOR 
:STEP IN SENSOR 



Est’imote: 5or Sensor Failures 
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for sensor steps and in this case as k-0 increases our certainty in the 
estimate does too. So again for jumps we find that the estimate does not 
ing>rove significantly over the value obtained after a couple of time steps, 
we know that we can't do better than that in estimating V. On the other 
hand, in the case of steps we see that a wait of 20 time stpes decreases 
C"^(kf0), the covariance of the estimation error, significantly. Figure 5.8 
contains plots of the estimate of the failure produced by the GLR detectors 
for a 50' failure in the sensor for q, both jump and step. We see that, as 
mentioned above, the estimate in the jump case improves little with time 
while that of the step case achieves its best values after 10 time steps 
(k>15). 

Before going on to the next section one last thing will be mentioned 
which provides some background for what follows and yields some insight xnto 
the dynamics of the detector. For failures of all kinds considered except 
for sensor jumps, when 0^ drops out c-. the window the detector selects 0^+1 
and then 0^+2, 0^+3,... as the value of 0. By the definition of 0, those 
values of 0 correspond to 0 with the largest Jl(k,0) in the window. We will 

try to understand this by means of an exanqple. 

Let us consider a simplified model of the aircraft dynamics which is 
valid over short periods of time. We can set the angle of attack a to be 
the integral of the pitch rate as a first order approximation. 


B M 13 S> 

State 
Failures 

System Filter 

Figure 5.9 

A jump in q b^re looks like a step in O to the filter which can only 
measure a. This similarity tells us that in the future there might be 
some difficulty in cross-detection fo” these two types of failures. 

For this system the filter can track a step input (with zero steady- 
state error) and thus G(k-0) goes to zero as k-6 increases for a jump in 
q or step in a, which to the filter look the same. However, for a step in 
q, this does not happen since it leads to a ramp at the input to the filter. 
ror this input the filter has a steady state tracking error and thus G(k-6) 
does not go to zero for this case. Therefore if we do not detect a state 
jump or a sensor step or jump quickly, it will go undetected. In the case 
of a step in q, however, it leads to a sensor ramp as input to the filter 
which leads to a persistent effect on the residuals. This means tiiat one 
will get more and more information ed>out such a mode as time goes on, 

A 

We now have a sensible explanation for the incrementation of 0 once 0^ 

drops out of the window as is the case for state steps, for example. When 

0 . the time at which such persistent and possibly increasing effects began, 
T' 
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A 

is no longer a candidate for 6 then j ■ k— M is seen by the detector 

as the most likely time of occurrance, where k-M is the earliest time in 
the window. The detector sees that some excitation persists throughout the 
entire window. Its best guess for its beginning is the earliest time step 
it can guess: the first point of the window. 

V.3 J|Mn £_FailurM t State and Sensors 

For lump failures we find that detection in general is very good. The 
presence of a failure is identified almost Immediately » with possibly some 
small delay in some of the failures of smaller magnitudes. When translated 
to real time these delays are 1/8 second or less. 

Figures 5.10 and 5.11 point out a basic difference between detection of 
state jun^s and sensor junqps. The graphs represent the values of Kk>6) for 
the 0 inside the window (those inside the window such that i(kj0)>e in 
Figure 5.11). Although they are given for different failure magnitudes, one 
is for a 10a state jun®> in q while the other is for a 20a* sensor junqp, they 
show typical lUk|0) profiles over a window. While sensor jumps result in 
distinctive spikes in the GLR’s for the times of failure, state jumps lead to 
<3«R profiles (as function of 0 for a given time k) which are smoothed out in 
seme sense. Thus, in general, detection of state jumps is less noise~sensitive 
than detection of sensor junqps. The system dynamics, in effect, act like a 
low-pass filter. 

As Figures 5.2 and 5.6 showed, for jump failures the estimate after a 
few time steps is already in some sort of steady state. Waiting does not 
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provide extra information for an improved estimate. As soon as 6^ leaves 
the window the estimates deteriorate, more gradually for state than for 
sensor failures. 

V.4 Step Failures: State and Sensors 

For the case of step failures both in the state and sensors, detection 

is excellent with some delay for the smallest failures tried* 1/20, l/2o* , 

1/100 and l/lOo*. The largest delay found was for a l/lOo failure in the 

state for angle of attack in which case it consisted of 13 time steps, or 

. -5 

0.4 sec. This failure represents a step in angle of attack of 2.2603x10 

radians or approximately 0.0013 degrees. 

As far as the estimation of the correct time of failure is concerned, 
given our fixed threshold in the simulations the critical factor is the size 
of the failures. In general we find that the estimate improves with time and 
so 0 undergoes a kind of transient and then tends to 6^. The reason for this 
is that the GLR's for the step cases grow in time, at least while 6^ rOTains 
in the window. For very smaJ.1 failures, 1/lOa and l/2o, 0 is very sensitive 
to noise, which is less Important for the larger failures. For state steps 
greater than 1/20, sensitivity to noise is greatly reduced while for sensor 
steps a similar reduction takes place only for failures greater than 10. 

This is not surprising if we recall the discussion at the end of section V.2. 
We saw that state step failures are in some sense equivalent to ramps in the 
sensors and will therefore lead to higher GLR values than sensor steps for the 


same failure size. 
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A8 in the ceae of state jua®> failures) we again find the same smoothing effect 
of the system dynamics on l(kfe) if viewed as a function of 0, that is, on 
the GLR profile over the times in the window considered at any one instant. 
However, we find that step failures in the sensors also manifest this same 
smoothing property for big enough failures (10a*, 20o'), i.e., with high 
signal-to-noise ratios. Figures 5.12 and 5.13 show the effect of sensor and 
state step failures in the pitch rate q, for two different times, on the 
GLR' 8. The graphs show the GLR profile" over the window for two different 
times and indicates tneir characteristic shapes. 

V.5 Threshold. False Alarms and Detection 

in this section we discuss some results from the simulations which have a 
bearing on our attempt to understand how the GLR detectors works and to 
develop some intuition about its behavior. The discussion so far has empha- 
sized the various failures tried and the range of response of the detectors 
given by the delay times of detection and the estimates of the failure and 
the time of failure, . We have hinted at the sensitivity of detector per- 
formance to the noise in the system, which mainly concerns us for the problem 
of detecting small failures. This is very close to the problem of false 
alarms, that is, the possibility of detecting 'something' when in fact no 
failure has occured. 

Detection has been defined in terms of the decision threshold explicitly 
by the rulei 
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Detection when i(ki6)>e, for k-M<0<W-N, 

One tfould therefore want to take a look at the changes in detection 
performance and on the rate of false alarms for different thresholde. 

The rate of false alarms that results from a specific inplementation of 
the detector is an important measure of their performance. This is true 
because false alarm rate is one of the parameters that defines the limits of 
acceptability in a given application. In the context of self-reorganizing 
systems, which respond to failures by Internally altering the control system 
logic to maintain given performance indices within specified bounds, a high 
rate of false alarm would lead to excessive and unneccesary changes. Such 
reasoning justifies our effort and time spent trying to analyze and then 
verify the false alarm probabilities for the various detectors. 

In Section II the false alarm probability is defined in a way that 
reduces to 

Pp®Prob ( A (k j 0) >c j H^) 

Sotne runs were made with no failures to see the rate of false alarms 
we would get and compare them to the computed values. Table 5.1 sunmarizes 
gp nw aspects of the results. The precomputed false alarm probabilities are 
given for cong^arlson. The simulatioi® were run for the threshold value c«5 
and the numbers for the other values of e were easily extracted from them. 
all quantities are based on the average over two sample runs. ND is the 
total nuiiiber of times of detection, i.e., the number of times k for which 
some i(k|6) exceeded the value of tl»e threshold. NDP, ho%#ever, is the more 


realistic measure of false alarm rates. It is the number of distinct 
detections: detections declared as different occurrences, i.e., with dif* 

ferent $ as time of failure, for example, three detections in a row, at 
k, k+1, k+2, declaring a failure at a particular 0^^ count only as one for 

NDD but as three for NO. The quantity NTS gives the total number of time 
steps that the simulations lasted, 20 for jumps and 40 for steps. 

The reason for looking at NDD is related to the concept of false alarms 
ing>lied by the definition of Pj,. Since P^ is based on H^, the no-failure 
hypothesis, and large values of the noise may be undistinguishable from jump 
failures, a true test for false alarms should not allow large noise spikes 
in the 'recent* past. A more accurate experiment to verify P^, wuld require 
us to re-initialize the detectors every time there is a false alarm. 


Threshold 

Computed 

State 

Jump 


Sensor 

Jump 


state 

Step 


Sensor 

Step 


ND/NTS 

NDD/NTS 

ND/NTS 
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ND/NTS 
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0.1625 
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Q.025 , 


0.0125 


0.0 


Table 5.1 False Alarm Rates for Different Thresholds 


AS expected, the measure of false alarms decreases for an increased 
threshold although there is a discrepancy with the precomputed One 

must keep in mind, however, the approximate nature of the counts in Table 
5,1 and the limited amount of data from which they are computed. It 
expected that for a much larger data base leading to more statistically 
significant, results, the number NDD/NTS would approach the computed Pp»s, 
Figure 5.14 is a plot of max4(k>0), the largest GLR at time k for 0 
in the window, for the state detectors with no failures. By considering 
various thresholds we can see how the number of false alarms would change. 
Although these curves are qualitatively representative of detector performance 
under the condition of no failure one must keep in mind that this was for 
one particular run, and tlmrefore true for a particular noise sequence. 

The actual values plotted would be different for another sample run, 

in general, raising the threshold to a value of e=7 eliminates a sig- 
nificant number of false alarms. Most of them are removed when e-10. 

However, the threshold is limited by the specified probability of correct 

detection, 

m t,Ultig th, ttiwrtwta w, mX. detection of eeiell felleree tore dtt- 
fleult and „ reduce the correct detKtion probability. Large failures 
(»10 or 10‘) are not atfactad because the OLR'a reach very high values 
alirost isnediataly. as failures of aiMller magnitudes ate tried however, 
a taiaad threshold result. In delays befora detection and in the possibility 
of missing the failure altogether if it is very small. This is especially 
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80 for small jump failures in the fjonsors, since the GLi'.'s reach the maximum 

value quickly anl decrease afterwards. 

Thus we see that this is a very practical question of performance ac- 
ceptability. It is possible that for some applications we know a priori 
that no small failures occur, or perhaps we are not concerned about them, 
then a higher threshold might be advisable. In conclusion, this is a ques- 
tion to be answered by the problem at hand and by the mininium standards of 
performance that are specified. 

From the simulation data it is possible to infer the detection behavior 
for higher thresholds. We find the following: 

Jump Failures 

For jump failures in the state of magnitude greater than or equal to 
So, detection is virtually unaltered when the threshold is raised from its 
original value, €=>5.0, except for the decrease in false alarms. In the 
case of 10 state failures however, a number of originally correct detections 
are eliminated along with the false alarms. This is mostly for k-0^ small 
so in effect we introduce a delay to the time of detection by raising the 
threshold. 

This is sunmarized in Table 5.2 where the delays in detection of failures 
are shown for state and sensor jun^s of different magnitudes and for additional 
values of the threshold. For a given failure and threshold, the two entries 
are the delays after 6^ until the first detection for two sample runs 
differing only in the noise sequence followed. An entry of * simply means 
that for those values there was no detection at the end of the run, at k“20 
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for jump failures and k»40 for step failures. It is probable that for a 
longer waiting time detecti<Mi would take place. Note the difference between 
the 10 state failures and those of larger magnitudes. 

Sensor failure detection shows similar .effects. The difference in 
detection between the two kinds of failure lies in the range of failure 
magnitudes below which even correct detection is affected (besides false 
alarm rates). For sensor jumps this degradation in performance is seen 
even for 5o* failures, although slightly less pronounced for this value. 

Once again this is seen in Table 5.2 where the same information is shown 
as for state junps. Also note that detection of sensor j- 4 n«>s in o is less 
sensitive to changes in threshold than similar failures in q. This is 
partly due to the fact that the measurement of a has a higher signal-to- 

noise ratio than the measurement of q. 

Furthermore, we find that for sensor jump the number of false alarms, 
which generally follow when 6^ drops out of the window, is significantly 
reduced for a raised threshold. Almost all such false alarms are eliminated 

for e»10. 

Figure 5.15 shows the values of maxJl(k»6) * Jl(k)0(k)) as it changes 

0 

with k for 50 state jumps and 50* sensor jump?. The time of failure and 
that for which 0^ drops out of the window are indicated. Notice the drop 
in the value of i(k>0(k)) for jumps, especially in the sensors, when 0^ 
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Table 5.2 Delays in Detection for Different Thresholds: 
Jump Failures Measured in time steps from 
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drops from the window. As we have seen before, in these cases the measur- 
able effect of the failure on the residuals goes away quickly. Therefore, 
if we think of the GLR detector as, in a sense, matching the failure signature 
characteristic of a particular type of failure {as given by G(k;0)), then 
one would expect that very quickly after 0^ drops from the window Jl(k;0<k)) 
would decrease. This happens because there is very littJs correlation with 
the information corresponding to 0^+j, where j is small. 

Step Failures 

For step failures, once again, sensor failure detection is more sen- 
sitive to changes in the threshold than state failures, Whereas for state 
steps of size l/2a or greater only a small delay to the time of detection 
is introduced, for sensor steps greater degradation in detection is seen 
even for lo' steps. A threshold of e*=14, for exan^jle, for the given 
window size used (M=30, N=0) makes l/lOo' sensor steps very hard to detect. 
Notice that if we also increase our window size enough we regain detection, 
although with a delay which might not be acceptable depending on the appli- 
cation. This is due to the fact that while 0^ remains in the window 
il(k)0(k)) is non-decreasing for the case of sensor steps. 

Figure 5.16 is a graph of t(k»0(k)) for l/2a state steps and 5a* sensor 
steps as it evolves in time. We can see the generally increasing nature of 
the GLR while 0,j, remains in the window for step failures, as mentioned above. 
Also note the rapid increase in the GLR soon after 0^. For higher failure 
magnitudes, the effect of an Increased threshold reduces to the elimination 


FAILED TIME 
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of false alarms and perhaps the introduction of a small delay in some cases, 
of the order of a couple of time steps* The figure illustrates another 
fact: the higher values of the GLR for state steps, even for smaller failures 

than sensor steps. It is a state step which leads to the most persistent 
effects and this is manifested in these graphs of the GLRS's, 

in Table 5.3 we have the delays to detection for step failures and 
various thresholds just as in the case of jumps. In the case of state 
steps greater than 1/100 detection does not degrade significantly with the 
increased thresholds. In the case of sensor steps this is true only for 
small increases in the threshold as large delays may be introduced for 
somewhat larger thresholds. In general it is true that failures of mag- 
nitude 50 and So* or greater are detected very rapidly and are not very 

sensitive to threshold changes of moderate size. 

Concluding, higher thresholds look promising if one is irterested in 
moderate sized or large failures. At the pilce of a possible small delay 
before correctly detecting the failure, one gains a considerable reduction 
in the false alarms. If, on the other hand, one is interested in small 
failures (<10 for state jumps, <50* for sensor jumps, <l/2a for state steps 
and <10* for sensor steps) , then the threshold selection roust be carefully 
made. The trade-off between acceptable detection and false alarms is much 
more sensitive to small changes in the threshold for this range of failures. 
The study of the various detection probabilities takes on special significance 


in making such decisions. 
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STATE STEP? (V,0) 


SENSOR STEP: (V,0) 


STATE STEP: (0 Vj) 


SENSOR STEP: (0 V^) 


c=5 e=>7 e=lo egl4 



i/lOo 

13.0 14.0 14,22 14,33 

l/lOO' 0,0 

3,0 

15 ,» 

27,® 

1/20 

5.0 5.0 6,0 6,2 

1/20' 0,0 

0,0 

15,0 

27,® 



Table 5.3 Delays is Detection for Different Thresholds: 

Step failures. Measured in time steps from 0^. 




One way to resolve this problem In the case of step £r ,urcs is to 

2 

'•use a longer window, thus allowing the non-centrality parameter, 6 , to 
Increase and so achieving a higher probability of detection. Another pos- 
sibility which one might want to look at is the concept of a variable 
threshold to be used for small step failures. Because of the growing 
GLR's, after a failure has been detected with a relatively low threshold 
e, one could raise the threshold to a value where only the highest GLR's 
would be accepted. This way the failure effects in some sense are isolated 
and tracked. This is a question for future consideration. 


In this section we will take e closer look at the n^(ki 0)# the 
failure signature matrices^ vihlch are at the center of all the computations 
which fifo place in the detector equations. If we recall^ Gj^(kj 0) propa- 
gates the effect of a failure at time 0 to the residuals of the Kalman 
filter at time k. 

We saw in section 2.2 that because we are working with linear systems « 
tiie residuals nay be deconqoosed into two components 

X(k) - X(k) + G(k> 0)v 

vAiere £(k) is the residual which would be present in the absence of failures 
and ]^(k) ■ G(ki 0)V is the contribution to the residuals from the failure V. 
The log-likelihood ratio t(kj 0) was seen to be a quadratic in the output 
of the matched filters, d(ki 0) , which in turn are weighted sums of the 
residuals. Both quantities depend directly on G(k; 0) : 


d(ki 0) 0)v"^(j)Y(j) 

C(ki 0) » 0)v‘^(j)G(j, 0) 


Jl(k» 0) » d^(kf 0>c“^(k» 0>d(k| 0) 

The G(k» 0) sre preromputable and in Figures 5.17 to 5.20 wo have 
plotted the elements of this matrix as functions of {k-0> <in our case 
G(k» 0) “ G(k-0) because the system is time-invariant) for the times 
corresponding to the window lengths implemented. Notice that in the 
case of state and sensor jumps. Figures 5,17 and 5.16, the elements of 
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G(k-6) die out as k-6 Incroaaea, Thla is what one would expect qualitatively 
for a stable system ainee the effects of an impulse are short-lived. Also 
note that for sensor jumps the faster. Recall that 

the sensor failures pass through one less Integration (only the Kalman filter) 
than state failures (system dynamics and Kalman filter) before reaching the 
residuals as seen at the end of section V.2, Also the system eigenvalues 
are near one, the stability boundary for discrete-time systems. It is not 
surprising then that the effects of state faUures on the residuals of the 
filter in thta case persist for a longer time than for sensor failures. 
Similarly, in the case of state and sensor step failures shown in 
Figures 5,19 and 5,20 we see a correspondence to the previously explained 
fact that their effects are more persistent due to their sustained presence. 

Let us make some simple observations about the propagation of the 
failures to the residuals of the filter. Consider a failure v of a given 
type and suppose we have computed the corresponding G(k» 0) for the appro- 
priate window size. The component ^^k) of the residual due to the 
presence of the failure is given by £(k) - G(k-6)v or, in our two-dimensional 

case, * 

FyiIK*! _ Kj(1c-91 ['’ll 

[yj(wJ ’ G2j(k-eiJ [vj 

til 

We see that G^^j^ and Gj^j ^ 

component of the residual. Alternatively, and give tlie effect of 
failure component on the different elements of the vector of 
residuals. 

In our case, with failures in orthogonal directions we get for the 
case of pitch rate failures 
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v’' . (Vj 0) I YjOl) - Ojj(lt-9)Vj 

. Gj^(k-6)v^ 

and similarly, for angle-of-«ttack failures 

« (0 v^lj Yj^(k) “ 

Yj(k) «« G22(1 c-0)V2. 

By Investigating the relationship between ^ and j^(k) on the one hand 
emd the relationship between j^(k) and JUk; 9) on the otiier, one can extract 
some more information about the degree of detectability of different 
regions in the failure spaice. Letting j^(j) “ 
expression for d(kt 9 ) , 


d(k» 0) » 


^ G’’(j» 8)v“^ 


(j) tx(j) + G(j; e)vl 


d(k; 6) 


j“6 


G’’^(j; e)v”^(J)G(j; 0) • V 


» d(k» 8) + C(k| 0)v 

where d(ki 0) is vdiat would appear if there were no failure at all. Then 
the log^likelihood ratio can be expressed in a similar fashion: 


)l(k> 0) - td(k: 0) + C(ki 0)vl^c"^(k> 0) ld(k: 0) + C(k» 0)vl 

- d'^(k: 0)c"^(k: 0)d(k» 0) + v’’c(k> 0)«c"^(ki 0)d(k: 0) 

?’(k» 0)c“^(k» 0)*C(k» e)V + V^ 0 (k; 0)c‘^(ki 0)«C(ki0)v 

= f(k» 0) + 2v'*’d(k) e> + v'^C(k> 0)v 

If we carry this analysis further by studying the incremental 
variations in il(ki 0) considering f (ki 0) as a nominal value we could map 




ly, -VyikTy 




out roqions in failure Apace, ^ ^2' which for different times in the 
windows lead to larger values of HOu 0) and thus Increasing the probability 
of detection. An analysis of this ki. d may indicate some a priori limitations 
in the detection of certain failures. By further investigating these plots 
of the-eleiiients of 6(ki 9) and those of C ^(k-6) shown before for the 
different failure types much qjialitative inf >rmation may be obtained o*' the 
performance of the detectors • 

Another related area of interest is that of finding approximations to 
the various curves. Computationally it would be advantageous to be able to 
replace the (k» 0) , for example# by sin?>le functions such as constants 
or ramps if detector performance keeps within acceptable boxinds. For 
exeunple# curves of the form 



Figure 5,21 

might be approximated by simpler ones of the form 





■I 


) 



I 
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or of the form 




The reductions in computation and storage might be significant enough 
to make the implementation of the full GLR more attractive from a practical 
point of view* Furthermore, one could try to select the aEprcximating 
functions in a way such that the sub*-optimal design is less sensitive to 
noise or certain parauneter changes, or to accentuate certain features vdiich 
would render failure classification an easier task once detection has taken 
place. Alternatively, it may be possible to formulate an optimization prob- 
lem the Solution to which gives the approximating functions, from a speci- 
fied class of functions^ which minimize while maximizing P^ or keeping it 
constrained to a certain interval (Pj^ O^a < 1). 

Further study of some of the possibilities mentioned seems fruitful 
in the long run s in ce they offer potentially useful implementation 
characteristics thus increasing the practicality of this approach. Overall 
performance might be Improved if noise and parameter sensitivity is 
reduced. When some sensitivity analysis is applied to the detectors it 
may be interesting to compare the perforiMuxce to that obtained through 
the use of the above approximations. 



J 

1 


j 
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V.7 Directional Effects 

Briefly, there are aome instances when detector hehavior shows some 

T 

marked differences between data for failures of type ' 0) , in the 

T 

pitch rate dynamics or observations, and that for failures of type (Or ^ 2 ^ ' 
in the angle of attack dynamics or its observations. Through the study of 
such partlculeu: features of the performance of the detectors we e;^ect to 
get some initial information on some sensitivity questions such as flexibility 
or rigidity of the detector response to changing failures, signal-to-noise 
ratios for the failures, etc* 

The most interesting behavior is captured by Figures 5.24 and S.25. 

They show plots of the likelihood ratios in the windows for two different 

times in the simulations. They are both for sensor steps; Figure 5.24 is 

for a 200^* step in the pitch rate sensor and Figure 5.25 is for a 209^' 

step in the angle-of-attack sensor. The shape of ^(k; 0) as a function 

of 6 for k » 12 is seen in Figure 5.24(a) and for k = 32 in Figure 5.24(b) 

for 6 inside the window at those times. The true time of failure is 6^ » 5. 

notice the monotonlcally decreasing shape from 6^ on of the £(k; 6) for 

(V^ , 0) the failure. Flgtire 5.25(a) and 5.25(b) show the corresponding 

T 

data for a failure in the other direction, (0 , V 2 ) . 

The diffc?*ence in the shape of the &(k; 6) is striking. In contrast 
with the first case shown in Figure 5.2A, the second case, shown in 5.25, 
is like a decaying exponential after 6^. This phenomenon becomes more 
noticeable and distinctive as the size of the step failure in the sensor 
is taken larger. It turns out that the first effect on the f(ki 6) shape 
is seen in detection of steps in the state in both failure directions. 
Moreover, the second kind of effect is seen in the shapes of f(ki 6) for 
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detections of state junv>s» also in both directions* As we try to understand 
what is going on which leads to these results we expect to clarify further 
some of the interactions between detection of failures with Ll.j GLR method 
and peculiarities or characteristics of the specific system worked with. 

Some of the questions in the first paragraph are of Interest here. 

We can make some remarks here trying to explain the first-order com- 
ponents of this behavior. In Figure 5.19 we saw the elements of the sig- 
nature matrix for sensor step failxires plotted versus k - (J for the window . 

size considered. Notice that the elements ^ 22 * give the 

effect of a step failure in a on the residuals, tend to zero while Gj^j^ and 
®21* give the effect of a step failure in q on the residuals, Increase 

reach non-zero values. Therefore the added components of the residuals 
due to a step in a begin to diminish immediately after they appear and, 

1 

not being very persistent, the i(ki 0) for 0 > 0^ decrease fastev than | 

i(ki 0) in the case of a step in q. In the latter case, a step failure ’ 

in q, the added components of the residuals are persistent, if not in- | 

creasing, and the J (k; 0) for 0 > 0^ decrease in value at a lower rate. 

While there may be other factors affecting the behavior of Kki 0), they : 

are secondary and modulate these first-order trends. | 

There are other nnall details also of similar features which point | 

1 

out differences in detecting failures in particular directions of failure 
space. For example, in detection of sensor steps in particular, the i(k» 0) 
are larger in value, on the average, for failures in (Vj^ , 0) than for 
failures in (0, It seems to be related to the noise handling 

capability in each case. In any case, it is necessary to understand the ] 

factors at %rark here, as in{)ortant questions on the usefulness and | 
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V.0 Conclusions and Future Inveatigations 

As stated in Section III the purpose of these simulations was to 
obtain meaningful results with physical Interpretation in order to get 
Insight Into the dynamics of failure detection via the 6LR approach » In 
the process we have gained seme experience with failure detection techniques 
and some understanding which allows us to evaluate the performance of the 
detectors being studied. It also helps us to find out what kinds of ques* 
tions we should be asking as we go along. 

A realistic and yet single model of an F-8 aircraft at a given 
flight condition was used in simulations In which the detectors corres- 
ponding to the various failure modes studied thus far were loqolemented. 

The raoige of failures considered provided I'S with a large amount of data 
which displays the basic features of the performance of the GLR detectors. 

The qualitative analysis and physical Interpretation of the simu- 
lation results havealready allowed for an Initial evaluation of the 
<d)served performance. They have also brou^t out some of the key factors 
determining the quality of detection. We expect to further enhance our 
understanding as we have more time to interpret these results and to 
integrate them with those to be obtained in the near future. 

The overall detection performance seen is excellent for this stage 
of our research. Detection tedees place Immediately for most failures 
considered^ certainly for the majority of those of direct interest from 
an applications point of view. Even those of very small size are still 
detectable » at least for step failures, although with some degradation 
In detection performance such as delays to detection time and reduced 
accuracy of the estimates. 
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Xn general, step failures are easily detected and identified and so 
are jung> failures of sufficient magnitude, larger than lo for example. In 
the case of jump failures those in the state are in general much easier to 
detect correctly than sensor - f ailu r es The noise effects are smoothed out 
by the system dynamics and the jump Itself showc up as a persistent dis- 
turbance in the measurennents. Thus we already anticipate some difficulty 
in distinguishing between state jump failures and sensor step failures of 
comparable size in cross-detection studies. Some initial simulation results 
in which all four detectors are implemented at once for a given failure 
seem to bear this out. This points to the importance or necessity of using 
more conplex techniques to be able to improve detection and to eliminate 
redundancy. This was one of the reasons for looking at detection methods 
such as the GLR approach in the first place . The use of more sophisticated 
techniques in detection and estimation of failures is undoubtedly necessary 
when one contemplates condensation in the filter and/or controller for self- 
reorganizing closed- loop systems. Otherwise one runs the risk of massive 
and costly system changes without the certainty and accuracy of estimates 
called for by such action and resulting in degraded, if not unstable, overall 
system behavior. 

The area of decision threshold selection and false alarms must be 

looked at in more detail. The apparent false alarm ratef< observed in the 

simulations are higher than the computed false alarm probability, Pp. We 

need to study the correlations between the i(k; 6)'s with both 9 and k 

varying. For the GLR method presently worked on the log-likelihood ratios 
2 

are noncentral x random variables and obtaining their correlations is 
difficult. This is <M«e of the reasons for studying the simplified GLR (6GLR) 
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method in which the failure is assumed to be of a fixed form and its estima- 
tion ia removed from tixe detection process. For this technique the i(ki 0)'s 
are qauaelan which tiierofore makes such statistical analysis 

feasible. He hope to derive such quantities as the conditional probability 
of a false alarm after a false alarm has occurred, the conditional prcdaablllty 
of detection after a correct detection and other similar ones of practical 
and theoretical interest. 

The SGLR will be looked at for other reasons as well. The detector 
equations are beinq developed for the four failure modes studied so far and 
the same failures will be simulated as for the full GLR once they are 
ready. Prom the results we get we expect to be able to answer some questions 
on siiqplifications and sensitivity. The amount of computation and storage 
necessary for implementing the SGLR method is significantly less than for 
the full GLR method so that questions arise as to whether the performance 
will also degrade accordli.gly. If not, there is the possibility of u.^lng 
the SGLR detectors during normal operation and of switching over to the full 
GLR once detection takes place. Because of ti\e greater ease and cost- 
effectiveness of the SGLR one may be able to inclement a bank of such 
detectors for a range of failures of Interest in the monitoring phase 
failure detection. There are many interesting and related questions which 
remain to be asked as we get more Involved in the analysis of the per- 
formance of the SGLR method of detecting failures. 

One of the next areas to be v->rked on, which is already under 
investigation and has been mentioned is that of cross-detection. This 
refers to the possibility of detecting some or all kinds of failures with 
a few or one kind of detector only. This is of obvious interest since 
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one of the drawbacks of the GbB approach as it is now implemented is the 
fact that a detector is designed for each particular failure mode. Bemarka 
similar to tho above ones for the SGLR also apply here except for those 
about correlations of Jl(kf 0) , a problem which remains in this case since it 
still is a X random variable. There are interesting comparisons to be 
made# once we have some data* on the minimum implementation required to 
achieve a specified performance in dstection as measured in sane relevant 
way. 

Another problem that we will be looking at in the near future is what 
ifQ call detection under mismatched conditions. Briefly « this refers to tho 
question of the actual performance obtained when the real system is somewhat 
different from the model on which our calculations for the detectors are 
based. Everything is done as before^ but the measurements are made on the 
of the aircraft at a different flight condition# for example, 
fig oxpect the results here to tell us something adjout the sensitivity of 
the detector performance with respect to changes in parameters of the model 
which is to represent our knowledge of the real physical system. By doing 
similar testa on the SGLR detectors we can evaluate the relative robustness 
of each design to varying conditions* Again these are very important 
areas that must be investigated since they have many ramifications of 
interest for applications. 

Still further along remains a more complete sensitivity analysis 
of both the full <3LB and the S6LB techniques. We expect to derive some 
equations for ♦he changes in certain variables of interest such as 
{c(k» the elements of the information matrix, and and with 

respect to variations in a parameter vector of inportance. 


t 
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VI . D«tf Had Deacrlption of thft Multiple Detector Slmulntlon Progrwn (MOSP) 

In order to obtain practical Inaighta Into GLR performance, extensive 
simulation experience is necessary, A single system provides a common basis 
for coinparlson and analysis. We are currently focusing our attention on the 
F-6 aircraft as described in Chapter IX, Simulations of a system under 
different oonditlons may have a large coinnon data set such as the detector 
matrices (i,e,, G(ki 0), c"^(k» 6), etc,). Hence an efficient simulation 
program must be able to take this into account to eliminate redundant 
generations of such data sets. In addition, the program should be able to 
handle different systems sequentially in a single run. Presently, only the 
fovur basic detectors (state jump, state step, sensor jun^ and sensor step) 
are simulated. However, other detectors such as simplified GLR will be 
considered soon. Therefore, the program should have enough flexibilities 
to allow additions. The Multiple Detector Simulation Program (MDSP) is a 
FORTRAN program which has been developed to achieve these objectives. 

The MbSP simulates a system with a single failure and with a set of 
up to four detectors simultaneously in operation. The MDSP can simulate 
any number of systems sequentially in each run. For each system, simula- 
tions can be performed with different sets of detectors, and for each 
systttit and each set of detectors, simulations may be done with a set of 
different failures, one after another. In order to rediice redundant 
computations of detector matrices, when detectors are used repeatedly, 
all detectors are computed before any simulation and stored. They are 
activated as needed. 

Another feature of the MDSP is its ability to simulate mismatched 
systems. The detectors can be computed according to one system and failure 
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mode While the eiinulatlons ere actually of another. This option Is al»ed 
at tt.e study of the sensitivity of GLR technique to system parameter 

variation. 

Th. following action will pt ..nt . doWllol d. 5 «lptlon of th. 
fMtyi.., .tructur.., function u«g. of MDSP. T 09 .thor with th. 
.ppuidix eontalnlng th. eomntol progrMi code Mid furthM: d.tnlls In 
th. ptogrm .igorlthn, thl. Motion ptovldos a eonplot. dMorlptlon of 
mSP. Plnnlly, loM po.alble furthM addition, to lOSP ar. diaouBHd. 

1 , The MDSPt Detailed Description 

An overview of the program functions Is presented In section I.l. 
1.2 contains the definitions of Input data and program usage. Section 1.3 
describes the structures of MDSP In detail. Precautionary rema - *re 
made in 1.4. 

not. that thl. auction la IntMdol to provUa a clMr view of th. 
approach and .tructur. of «BSP m«J th. d.tall«> duKirlptlon of algorithm. 
1. not Includad. Ih. ra«l.r 1. rofarrad to the comm.nt.d progrM cod. 

In the appr tdlx. 

« 

1,1 Program Functions 

MDSP simulates Unear constant discrete time systems and Kalman 
filters as described In Chapter 2. Purthermore, the filter Is assumtd 
to have reached a steady statei hence the filter gain K(k) becomes a 
constant matrix K. 

The failure nodes that MDSP Is able to simulate are state jump, 
state step, sensor jump and sensor step failures numbered type 1, 2, 3 
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and 4 respectively. The detectors that are based on these failure inodes 
are nuulsered type l» 2, 3 and 4 representing state jump, state step, sensor 
jun^ and sensor step detectors respectively. More detailed model descrip- 
tion of the failures may be found In Chapter 2. 

The sequence of operatiorsof MDSP may be traced through by following 
the function flow diagram (Figure 6.1). It Is helpful to bear In mind 
that MDSP is divided Into six blocks (0, 1, 2, 3, 4, 5) each having a 
different function. After Initialisations in block 0, the system and filter 
matrices are read in (block 1) . All the detector matrices required In the 
subsequent simulations are computed according to this system and filter 
(block 2). If a mismatched system simulation is not chosen, the progrm 
proceeds to set up the bank of detectors (the detectors chosen to operate 
simultaneously during a simulation) in block 3. Otherwise, the mismatched 
system and filter matrices are read in (block 0) , replacing the previous 
systm filter, before setting up the detector bank. The new system 
and filter axe the ones to be simulated; the old system and filter are 
the ones the detector system is based upon. Then the simulations of the 
system, filter and detector bank are performed in block 5 with each of the 
de Bl gn ^»»*«^ failures inputed in block 4. During the simulation, outputs 
consisting of detector decision, values of the likelihood ratio, etc., are 
also provided. After all the simulations of the failures are processed, 
the program proceeds to determine if another detector bank has been chosen 
by the user, if so, the now detector bank is set up (block 3) and the 
cycle repeats. Otherwise MDSP will determine (through data cards) if 
uiother system is to be considered. If so, the process after initialisa- 
tion is repeated. Otherwise, MDSP will terminate execution. 


Q ■ : » 
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1,2 Pro<|rain Usaq^i and Input Data 

Execution of the program is controlled by variables in the input 
data set which can be categorized into four subsets t 

(I) System and Filter Matrices I/O 

LNS - ms ■ 9 signals that execution will teradnate after the 

present system has been simulated, Otherwise> the program 
will proceed to consider a new system after the present one, 

IHEAD ** to integer array containing the heading or title of the 
systemi its maximum length is 68 characters. 

NX “ dimension of state vector 

NZ - dimension of sensor vector 

lOS - I/O control variable of matrices: 

lOS = 4 - read auid write matrices with title cards 
lOS ■ 5 - read matrices with title cards. 

LSS - mismatch control. If LSS - 0, no mismatched system simu- 
lation will be performed. A nonzero value indicates a 
mismatched Simulation. 

lOM - I/O control variable of matrices of the mismatched systemi 
it takes the same values and meaning as lOS. 

These variables ate all entered on one card with the following format i 

read (5, 11) LNS, IHEAD, NX, NZ, lOS, LSS, lOM 

11 FORMAT (11, IX, 17a 4, 2(12, IX), IX, Jll) 

In addition, we have the matrix variablest 


..•S£3=A 


|V» * *n 


I 
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PHI - 9 
H - H 
GHX - Gj, 
GHZ - G, 


PK - K 


PP - P(k|k-1) in steady state, i.e. k-*« 

P - p(k|k) in steady state 

All of these matrices are read in and printed out using the subroutine 
MATIO. The formats involved are: 

Title Card: 

READ (5, 1002) 

1002 FORMAT (IX, 79H) 

HRITE (5, 1002) 

Matrix entries : 

E.ch ro« of » Mtrix 1= .tatt*a on « new c«dl a row contninln* 
not* elea«nt. thm a alngle card can hold nay use aa many carda aa raqnlrad 
a. ion, a. th. alamant. ara antarad conaacoUvaly. the fonaat ln«l«d 1. 
1000 FORMAT (SElO.O) . 

(11) coBC>utatlon and storage of Detector Matrices 

Thia aat of data la antarad via a namallat, DETCHP and hanca followa 
the namelist input format# 

nod - number of detectors to be computed and stored. 

lOD - tOl*. output control of detector matrices. If lOD - 0, 

no printing of matrices is done. A nonzero value will cause 


M(I) (see below 


the printing cf G(k-6) for k-6 ■ 0, ... 

for definition of M(I) , N(l) and c’^(k- 0) for k -0 - 
N(I)« ... M(I). Sinple modifications may be made 

to point out other matrices such as P(k-0), Gi(k-0)V etc. 

XD > (11 an array containing the detector type number to be 
confuted. 

M - (111 . array of the values in the detector window specification. 

N “• (01 • array of the values in the detector window specification. 

(I0(I)# M(I), N(I) ) specify the type and wii«aow of the detector 

in storage. 

*( 1 contains the default values if no value is specified on 

data card. The variables ID. M and N are arrays and each element 

in these arrays takes a default value as indicated in the brackets. 

(Ill) Detector Selection 

Xhis data set is also entered via a namelist. DETSZL. vAiich spe~ 
cifies the detector bank for simulation. 

UiD - (01. IHD ■ 9 indicates the end of simulation of the present 
system. Otherwise, a new detector bank is chosen for simu’' 
lation and it is specified in this namelist. 

IDS " array containing the detector types in the bank. 

MS - (111. array of the M^ values of the detectors in the bank. 

HS - (01 . array of the values of the detectors in the bank. 
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EP - 161 . array of ^ LR threshold values for the detector in the 
bank. 

{lDS(Z)» MS(I), NS(i), EP(D) specifies the 1^^ detector in the 
bank. The detector should only contain detectors that are in storage 

and possibly with windows that are smaller them the corresponding ones in 
storage but these windows must be contained in the ones in storage. 

(IV) Failure and Simulation Data 

This set is entered via the namelist FASIM. 

LNF - [01. LNF * 9 indicates the end of simulation with the present 
detector bank. Otherwise, simulation is to be performed with 
the true failure specified in this namelist. 

lOP - (21 . Outpw option for detector decision; it cw take on 

possible values (1, 2, 3). The options are explained in the 
next section under block 5. 

IFL - [11 • the type of failure to be simulated. 

KTF - [31. the true failure time ( ^ 1) 

NXM - [151. time after which simulation is to stop. 

RNU - [01 . failure vector v (of type ILF) . 

(V) Captions 

This data set is constant and is read in only once and Isefore all 
other data. It consists of two integer arrays, ITYPE and IDET %diich 
contain characters that are to be printed at appropriate places of the 


output as captions 


, *1“ '* 
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ITYPE - a 5x4 array with contents t 

locations contents 

jTyPE{l»l) for I ■ 1,2,... 5 JUMP IN STATE AT 

ITyPE(I,2) for I - 1,2,... 5 STEP IN STATE AT 

ITYPE(1,3) for I ■ 1,2,... 5 JUMP IN SENSOR AT 

ITyPE(I,4) for I - 1,2, ...5 STEP IN SENSOR AT 

IDET - a 5x4 array with contents t 

locations contents 

I0ET(I,1) for I ■ 1,2, ...5 STATE JUMP DETECTOR 

1DET(I,2) for 1 - 1,2,... 5 STATE STEP DETECTOR 

1DBT(I,3) for 1 - 1,2,... 5 SENSOR JUMP DETECTOR 

IDET(I,4) for I » 1,2,... 5 SENSOR STEP DETECTOR 

Under this setup, the siib-acray of ITYPE with a falltire type 

as the constant second array Index contains the description 
in words of the failure type. As a result, the failure description is 

by the failure type number. IDET and detector type nunber have 
the sasie relationship as ITYPE with failure type number. 

For the present version of MDSP, detector type as well as failure 
type can take on four valuess 1, 2, 3, 4 representing the four basic 
^ypag) state junvp, state step, sensor Jump and sensor step respectively. 
Mote that the main program control variables are the flags IMS, LSS, IMD 
and LMF. 

TO illustrate the ordering of these input data, the following 


example is Included 
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1.3 Pro9ram Structure 

MDSP iB divided into six blocks that Interact with one another much 
like subroutines. The subroutine approach is not employed due to th« need 
to pass a large number of arguments and the number involved. The bLocks 
are separated clearly both functionally and physically so as to facilitate 
the understanding of the program. The one disadvantage is that t-ttention 
must be paid to variable names so that they are not used for different quan- 
tities in future alterations of the program. 

The six blocks divide the code according to the following conventions* 


statement numbers block function 


Block # 

from 

to 


0 

0 

999 

initialisations 

1 

1000 

1999 

system and filter matrices I/O 

2 

2000 

2999 

compute and store detector siatrices 

3 

3000 

3999 

detector selection 

4 

4000 

4999 

input failure and simulation data 

5 

5000 

5999 

simulation and output results 


There are no intermingling and overlapping statements from different 
blocks and there are comment statements separating the blocks and stating 
functions. All format statement numbers contain at most two digits 
with the most significant digit indicating the block number in Which the 

format is first used and defined. 

The following is a description of the block functions. 
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(I) Block 0 - initltllsations 

Thla block Initializes some Interval variables of the program. (For 
details consult comments in program code) . The caption arrays ITYPE and 
IDBT are initialized via read statements. 

(II) Block 1 - System and Filter Matrices I/O 

This block provides the cede for reading in and printing out system 
and filter matrices as well as the I/O for the mismatched system and filter. 
In fact* the code and storage are used for the original and mismatched 

matrices. If the mismatch option is used, the original system matrices are 
erased after the detectors are calculated. 

(III) Block 2 - Congmtation and Storage of Detector Matrices 

As the execution of this block begins, the data namelist DETCMP is 
read in. By detector (matrices), it is meant the matrices F(k - 8), 

G(k - 0), G»(k - 0)v“^, C(k - 0) and c“^(k - 0). Even though not all of 
these matrices are used in the other blocks in the present version of MDSP, 
all of them are stored, anticipating future additions that would utilize 

them. 

The 6 matrices of a detector are ordered in increasing value of 
k - 0 and stored in a section of a big storage area for the G matrices of 
all the detectors chosen to be stored. Pointers are created to indicate 
the beginning of the sections for different detectors. Other detector 
matrices are likewise stored. The term "pointer'* has the meaning of an 
"offset" throughout the content of this documentation. Rather than 
pointing directly to any section, the pointer provides the storage space 
to be skipped from the very beginning of the big storage to get to the 


section. We have the following relation of storage and pointers. 


matrix 

type 

name of the 
single matrix 
in program 

name of the 
big storage 

pointers 
associated with 
tiie storage 

F(k-0) 

F 

FS 

LF 

GOc-6) 

G 

GS 

LG 

G*(k-e)v"^ 

GTVIN 

GVS 

LV 

C(k>6) 

C 

CS 

LC 

c“^(k-0) 

CIHV 

CIS 

LC 


Note that the pointers are In fact arrays. 

Bacall that the dimension of the G matrix depends on the type of 
failure assumed, (NZ) x (NX) for state faUures and (NZ) x (NZ) for sensor 
failures. Hence, the second dimension varies from detector to detector 
«d 1. .tot.d 11. M. «r.y ure. Then for th. I** detector, w h.« the 
following specifications and pointers* 

{1D(I), M(l), N(l), LNZ(l), U3(l)» LP(D» hC(I>» 1*V(I)>. 

The sites of the sections In storages nay be determined as foUowst 

site of section 
(NX) * (M(l) + 1) 

(NZ) * (M(l) +1) 

LNZ(I) * (M(l) - N(l) + 1) 
mz(i) * (M(l) + 1) 


Storage 

FS 

GS 

CS, CIS 
GVS 









! 
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According to the previously defined nuture of the pointers, we heve 
LG(1) 1^(1) • 1^(1) “ LV(l) " 0 

The value of the (l+l)st pointer Is equal to the value of the Ith pointer 
plus the size of the ith section* 

yor nonzero values of lOD, GS and CIS are printed. However, other 
storages may also be printed with some very simple addition to MDSP. 

(IV) Detector Selection 

The namelist DETSEL is read in at the beginning ot tne Mock. 

Since all the detesctors have been computed and stored, any selection 
of these detectors only involves the correct identification of pointers. 

For each value in IDS < indicating the detector type) the array ID is 
searched for the same value. Then corresponding values in the pointer 
arrays set up in block 2 are assigned to a new set of pointer arrays, 
consider the 1th detector in the detector bank. If 3 is the index of ID 

such that 

IDS (I) - ID(J) 

then we set 

JG(1) - LG(J) 

JP(1) - LP(J) 

JC(I) - LC(J) + WSil) - »(1)) * LH8(d) 

JV(I) • bV(J) 
dMZ(I) - LNZ(J) 

If IDS (I) does not have a matching value in ID or IMS(I), NS (1)1 is 
not ««p.tlbl. with CMW), HWn, l.«. HSH» > «U) thd/ot HS(I) < Bt3) 
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then IDS (I) Is dropped and the following values in IDS, MS, and NS are 
moved up in the arrays while a message is printed indicating such inconr 

patibility. Then NUDS is also decremented by 1. 

Since we allow NS(1) > N(J), the first C matrix in CS we want 
considered is NS(1) - N(J) matrices after the beginning of the section. 
Hence, JC(I) - LC(I) + (NS<I) - N(J)) * UJZ(J). 




CS V 

C(N(J)) 1 

LG(J) 


C(N(J)+1) 1 

• 

• 

• 



C(NS(X)) 



(NS(1)-N(J))*UI2(J) 


JG(I) 


in addition, two more pointer arrays are created* JR and JD. The 
former points to GLRS (storage for i(k, 0) of all the detectors) and the 
letter points to DTS (storage for d‘ (k| 6) of the detectors) . The nature 
of JR and JD are similar to the other pointers. The alaes of the Ith 
sections in GLRS and DTS are MS(1) - NS(1) + I and MS(1) + 1 respectively. 
The detector bank specifications (IDS, MS, NS) are printed for 


eacy reference. 


I 
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(V) Block 4 - Input Failure and Simulation date 

Here the naneliat FASIM is read in and information contained in 
FASIM is printed out for easy reference. 

(VI) Block 5 - Simulation and Output 

This block consists of four sub-blocks* (a) system and filter 
simulation, (b) generation of i(k, 6) for the detectors in the bank, 

(c) detector decisions, and (d) output. 

(a) System and filter simulation 

The system is simulated with the failure specified in block 4. The 
filter generates the residual necessary fw the detectors. The algorithms 
involved are simple and the code is self-explanatory. 

(b) Generation of f>(k} 6) 

The computation of d(ki 8) and i(ki 6) is straightforward. However, 
the manipulation of quantities in the storage DTS is Involved and is 
explained in detail in the appendix. This sub-block generates the 
d(ki 8)'s and l(k| 8)*s for the detectors in the bank via subroutine 

calls to GEtSLR. 

(c) Detector Decision 

The 6LRS array is examined to determine if any i(k» 8) is greater 
than the thresholds (BP). The number of i(ki 8) crossing the threshold 
is recorded for each detector and the five times (values of 8) that have 
the largest Kki 8) exceeding the threshold for each detector are 
ordered in decreasing values of )t(kf 8). 


A likelihood estitoate (MLE) of the failure vector 

ie for the 0 the has the largest t(ki0) by each of the detectors that 
detects a failure (i.e. having some a(k|0) exceeding the threshold). 

(d) Output 

Presently there are three output options all of which deal with the 
plotting of GLR bar graphs. At each time step, the tine and the Kalman 
filter residual Y are printed. For all three options, if no l(k>0) crosses 
the threshold for a detector, nothing is printed for that detector. 
Otherwise the following is printed for the detectors 

1. detector number - is the number J such that IDS(J) specifies the 
present detector and hence is not the type number. This is done 
because the detector bank may contain two detectors of the same 
type but having different windows. Then the type number is not 
a good identification. (The correspondence between a detector, 
its description (type window and threshold) and its detector 
number in the bank were pointed as block 3 was executed). 

2. the largest l(k»0) value. 

3. the five values of 0 having the largest Jl(k»0) exceeding the 
threshold ordered in decreasing values of l(k»0l 

4. MLB of the failure vector (RNUE is the estimate in the program) . 
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Por the bar graph output: 

Option 1 (IOP»l) - no ploting of bar graph. 

Option 2 (I0P«2) - plot £(ki6)'s for all detectors in simulation 
if any detector detects a failure, 
option 3 (I0P»3) - plot i(k|0)'s for all detectors in bank at all 

tines. 

Por a detector that does not signal a failure (no i(k|0) exceeds 
threshold), the bar graph of Mk,0) is scaled as the threshold equivalent 
to full scale. Otherwisej the largest f(k>0) is the full scale value. 

1.4 Words of Caution 

MDSP manipulates a large number of arrays. Hence, much attention 
should be paid to the dimensioning of arrays to avoid painful error such 
as writing over onto other arrays. Rules and advices may be found in the 
comnents in the code. 

Many of the matrix manipulations 4n the program employ subroutines 
developed at the Electronic Systems Laboratory (ESL), M.l.T. (e.g. MATIO, 
MMUL, MRT4, etc). The BSL has also developed discretisation and Kalman 

filter gain cotq>utation packages which were used in obtaining the system 

* 

and flltex matrices of the second order P-8 in our simulation studies. 

MDSP Is compatiblo with the above packages* 

The subroutine, GAUSS, used by MDSP to generate random numbers is a 

subroutine from the IBM scientific package. 
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II. Plexibility for further Modules 

The block structure of the program has no complicated inter-block 
interactions. This facilitates the additions of further nodules as new 
blocks. The lack of intertaining logic in MDSP (except in Block 5 where 
the d'(k|0) vector are generated and where detector decisions are made} 
but both of these processes are self-contained units) makes the addition 
of sub-blocks simple. 

Presently the addition of simplified GLR detectors to MDSP is being 
considered. Computation of the two probabilities, P^^ and Pp of the 
detectors and sittulation of multiple failures are examples of possible 
additions and expansions of MDSP. Furthermore, MDSP may be easily modified 
to accept residuals of the Kalman filter from an external source, making 
it possible to be used in conjunction with, for instance, a non linear 

simulation. 
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Vll. Future Work 

Based on the results outlined in this report, we plan to consider the 
following issues. 

taskjlt Cross-Detection and Wrong-Tinww Probability Calculations. We 

plan to apply the techni^es outlined in Section II to the simplified P-8 
model. 

Task #2t Measure of Failure Mode indistlnguishabillty. Motivated by the 
cross detection problem, we are planning to develop a measure of mode 
indistinguishability. Our initial attenpts will involve the use of inner 
products of failure signatures and the definition of “orthogonal failure 
modes." we hope to develop a Gram-Sehmidt orthonormal iaation Procedure 
for a set of failure modes. The idea here is to determine a transformed 
set of signatures so that only one likelihood ratio will become large when 
any particular failure* occurs. This will greatly simplify the resulting 
detector decision logic. In addition, this study can lead to the determi- 
nation of a small set of "universal signatures," which con be used to 
detect a wide variety of failure, the idea being to use these signatures to 
detect failures with subsequent isolation provided by correlating reel u 
with a larger set of signatures. 

TOrt #a, s.qM<itUl rt<>biJ>iUtl.* for SOLR. in soetloi. II «n4 IV, « 
Mtod th.t If on. otlltn.4 Vh. .pproMh to 0l», on. «ool4 n..4 to 

onlooUt. Joint ptobrt>lUtU. ttot lUt.Uhood r.tlo. I(k,e) .«o..4 .on« 
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threshold. In addition, at the end of Section IV, we proponed a possible 
detection scheme that requires K likelihood ratios to exceed a threshold. 

By doing this, we may reduce false alarm problems substantially. Recall 
that in Section V we obser^red that false alarms occurred in bursts ~ l.e. 
one bad data point would successively trigger off a number of alarms. The 
approach outlined in Section IV would help minimize this problem. We also 
note that, as described in Section V, the shape of the set of i(k»8) after 
a failure is quite distinctive and is much leas so when false alarms occur. 
Thus, it is clear that a study of the correlation behavior of the LR's 
would be extremely useful in allowing one to utilize the GLR data in an 
optimum manner. However, as mentioned in Section II, the LR’s in the full 
GLR case are noncentral variables, and the study of correlated variables 
of this type is quite difficult. Thus, we propose to study these questions 
for SGLR, where all of the variables are Gaussian. We feel that SGLR is 
"close enough" to GLR so that our analysis will be valid (in general terms) 
for full GLR as well. Thus, we plan to examine the sequential correlation 
of SGLR's and to use this information in the development of efficient detec- 
tion rules. In addition, one of our first uses of this information will be 
in the calculation of delay time in detection ~ l.e. the calculation of 

Prob I i(k»6)>e i(0f0) ,...,fc(k-l>0)<€» and a failure j 
V occurred at time 0 

We feel that this task will provide some of the most useful tools for future 
development of the GLR technique* 


i 


yaak »4 t cross Detection Simulation Studies. We plan to run a series of 
simulation runs using the simplified F-8 model in order to study the 
qealitatlve properties of GLR cross detection. We hope that these results, 
together with the indistinguishahillty.rfi8ult8jfrom « a„d the analytical 

tool of Task #3 will allow us to develop a method for minimising the cross 

detection effect. 

TftskJSi Sensitivity Studies and simulations. One of the key unanswered 
questions is the robustness of GLR to model errors. We plan to run a series 
of simulations in which the GLR is designed based on the linearised P-8 
dynamics at one flight condition, while the plane is actually at a second 

condition. 

Task »6t Simulations of SGLR. It has been conjectured that SGLR, while 
not as accurate a detector as GLR, might be far less sensitive to parameter 
errors. We plan to implement a set of SGLR simulation routines and to 
run a series of simulations in order to study the utility of this method. 
Task »7 i Development of Several Pedagogical Exaitples. The GLR approach 
as we have been developing it has a number of aspects that are somewhat 
subtle, we feel that in order to clarify these issues, it would be nice 
to have several very simple test problems that make the various points 
relatively easy to observe. We have already done this once (in Section V) 
and will attempt to find several other test problems that illustrate key 
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There are clearly a number of other leeuea titat must be considered In 
this stttdyi however^ the above represent those tasks we plan to complete 
during the present grant period* A full set of additional tasks will be 
spelled out In the proposal for continuation of the grant. 


I 
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Appendix 


t. Algorithms in MDSP 

All the algorithms used in the MDSP are straighforward except the 
generation of d(ki6) and l(k»0) in block 5. The computation of d(ki6) 
is performed in the subroutines GENDLR called in block 5 according to 
the formulast 

(1) d(k+l|0) • d(k»0) + G'(k+l-0yv“V(k+l) 

(2) Mk+l>0) - d'(k+l|0)c"*‘(k+l»0)d(k+lf0) 


d(kiO) may be expressed alternately ast 

k 

(3) d(k|0) - ^ GMj-0)V YCj) 


For a f ea sible realixation of the GLR detection scheme, a finite size 
window characterized by k-M<0^k-N is used. The computation of d(ki0) 
requires k-0+1 data points and in particular, d(k»k-M) requires M+1 data 
points from k-M to k. Consequently, the actual window k-M^0^-N implies an 
affective window k-M<0^k within which all the d's have to be stored to 
utilize formula (1). (Alternatively, M+1 Y*s would have to be stored to 
use formula (3)). 

There are several ways to store the d’s in the effective window to 
ccxiserve storage. The scheme employed in MDSP is as follows. Consider 
the section of DTS (storage of d’s for the whole detector bank) for the 
detector in the bankt 


JD(1) 



At time K+l, d(k|k-M+l) through d(kik) may be incremented to form 
the M d*8 for the effective window at k+1 via the recursive formula (1). 
However, d(k|k-M) is not used since its incrementation gives d(k+l|k-M) 
indicating an observation point outside the effective window into the 
past and hence a point outside the actual window. But this storage space 
is now used for d(k+l|k+l), a new point in the effective window 
acquired through the sliding of the window. Continuing this -replacement- 
process, the same section of OTS at various times contains i 


DTS 





d'(kik-M) 


(k+l.k+l) 

d* (kik-iw-li 

d* (k+lik-Hfl) 

• 

• 


• 

• 

• 

d* (kik-l) 


d* (k+lik-1) 

d»(kfk) 


d‘(k+lik) 





k k+1 





d* (k+Mik+l) 


d* (k-t-M+lik-fl) 

d(k4Mik42) 


d* {k+M+lik+2) 

• 

• 


• 

• 

d* (k+Mik+M) 


d* (k+M+lik4M) 

d* (k-i-Mtk) 


d» (k+M+lik+M+l) 

k<^M 


k+M+1 




fff«otiv«ly hav« treated thla aection of atoraqa as closed and or 
"circular** atoraga. 


JDU)+1 

JD(X)+2 


JD(I) JD(1)+M+1 

O .TD(l)+M 

JD(1)+M-1 


TO be abl« to toll «har« the enao of th. offectiv. wii>4o» at., «e 
•teflMd anothoc offaat array JS. IJD(I> + JS(I)1 points to tha fartha 
point Into tha past In tha etfaetlve alndow. Hanee JS(I) la an offaat 
from tha polntar ro(I). Othar points In tha «inaow may ba aaally looatad 

traatlnp tha storaga aactlon aa a “circular" storage. 

AS each datactor la «rtl»atad, thara la a tranalant during which 
tha affactlva window la not flllsd l.a. that, laanm such that Oim<M and 
9.k-M<k„, tha atartlng tlma. Hance.'durlng th. tr«..i«.t, th. aft«!tiva 
.indowa la maallar th«i It la later. A. time prograaaae, tha affactlva 
window grow, until it r««ha. its full ala. (Mtl). Tharafora, w. define 
«. array JM to record th. alaa. of tha affactlva window, of tha datactora 
in th. b«>lt from th. starting tin. on. Ih. affact of 3S J« on th. 
atorag. aactlon may b. ba«. vl«..ll«d via a diagram. For simplicity, w. 

lot M-3, 



: JD(I) + mm 

— O s JD(I) + JS<1) 

mu that JM(1) is set to H for k>««. After the transient (Mel tiae steps) 
JS(I) is reset to tero every «♦! tine steps siioilatin, the •cironler- effect 

of the storage. 

mr eech n«( set of 4*., e set of f . is coaput.4 for the ectul window 
(l.e. k-M<e<k.l« K>a stored in the GUIS errey in the foUowin, Manner. 





t(k;k-N) t(kjk-N-l) 


A(k»k-M+1) i(kik-M) 


Except the updating of JS and JM as time progresses, the process 
described in this section is carried out by the subroutine GENDLR. 







